pterodactyl vulnerabilities
28 published CVEs name pterodactyl among the affected products.
- 28Published CVEs28 of them scored
- 14Last 12 monthspublished in the last year
- 6Critical12 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-86177
Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
pterodactyl · panel
High8.7 - CVE-2026-61617
Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion
pterodactyl · wings
High7.7 - CVE-2026-52856
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
pterodactyl · wings
High7.5 - CVE-2026-52855
Wings exposes node configuration secrets through egg configuration-file templating
pterodactyl · wings
Critical9.9 - CVE-2026-52857
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
pterodactyl · wings
Medium5.5 - CVE-2026-61609
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
pterodactyl · panel
High7.5 - CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
pterodactyl · panel
High8.1 - CVE-2026-35202
Pterodactyl has a database resource limit bypass via race condition in Client API
pterodactyl · panel
Low2.3 - CVE-2026-26016
Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
pterodactyl · panel
Critical9.2 - CVE-2026-21696
Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered
pterodactyl · wings
High8.3