pterodactyl vulnerabilities

CVEs per yearBy the year they were published

1. 20191
2. 20214
3. 20233
4. 20245
5. 20251
6. 202614

Newest CVEs

• CVE-2026-86177

  Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

  pterodactyl · panel

  High8.7
• CVE-2026-61617

  Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion

  pterodactyl · wings

  High7.7
• CVE-2026-52856

  Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

  pterodactyl · wings

  High7.5
• CVE-2026-52855

  Wings exposes node configuration secrets through egg configuration-file templating

  pterodactyl · wings

  Critical9.9
• CVE-2026-52857

  Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

  pterodactyl · wings

  Medium5.5
• CVE-2026-61609

  Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

  pterodactyl · panel

  High7.5
• CVE-2026-54593

  Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

  pterodactyl · panel

  High8.1
• CVE-2026-35202

  Pterodactyl has a database resource limit bypass via race condition in Client API

  pterodactyl · panel

  Low2.3
• CVE-2026-26016

  Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

  pterodactyl · panel

  Critical9.2
• CVE-2026-21696

  Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered

  pterodactyl · wings

  High8.3