pterodactyl panel vulnerabilities

CVEs per yearBy the year they were published

1. 20213
2. 20242
3. 20251
4. 20269

Newest CVEs

• CVE-2026-86177

  Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

  pterodactyl · panel

  High8.7
• CVE-2026-61609

  Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

  pterodactyl · panel

  High7.5
• CVE-2026-54593

  Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

  pterodactyl · panel

  High8.1
• CVE-2026-35202

  Pterodactyl has a database resource limit bypass via race condition in Client API

  pterodactyl · panel

  Low2.3
• CVE-2026-26016

  Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization

  pterodactyl · panel

  Critical9.2
• CVE-2025-69199

  Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances

  pterodactyl · panel

  High8.3
• CVE-2025-69198

  Pterodactyl's improper resource locking allows raced queries to create more resources than alloted

  pterodactyl · panel

  Medium6.0
• CVE-2025-69197

  Pterodactyl TOTPs can be reused during validity window

  pterodactyl · panel

  Medium6.5
• CVE-2025-68954

  Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced

  pterodactyl · panel

  High7.5
• CVE-2025-49132

  Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution

  pterodactyl · panel

  Critical10.0