Pterodactyl Panel (< 1.14.1) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/pterodactyl-panel--1.14.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 05 Sep 2026 11:32:07 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgPterodactyl Panel Authorization Bypass in Scheduled Taskshttps://feed.craftedsignal.io/briefs/2026-09-pterodactyl-auth-bypass/Sat, 05 Sep 2026 11:32:07 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-pterodactyl-auth-bypass/Pterodactyl Panel versions prior to 1.14.1 contain an authorization bypass vulnerability allowing subusers with limited schedule update permissions to execute arbitrary console commands.Pterodactyl Panel before version 1.14.1 contains an authorization bypass vulnerability identified as CVE-2026-86177. The vulnerability exists within the application's permission validation logic for scheduled tasks. A subuser assigned only the 'schedule.update' permission can craft malicious scheduled task requests that include unauthorized actions, such as executing arbitrary game-server console commands, modifying server power states, or initiating backups. This flaw effectively grants unauthorized subusers elevated control over game server instances, bypassing intended role-based access controls within the panel. Defenders should prioritize patching to version 1.14.1 or later to mitigate the risk of unauthorized server management and command execution by low-privileged accounts.

Impact

Successful exploitation allows a subuser to execute arbitrary console commands with the privileges of the game server process, leading to potential RCE, unauthorized data access, or denial of service by manipulating power states and backups. This impact is significant for hosting environments managing multi-tenant game server infrastructure.

Recommendation

  • Upgrade all Pterodactyl Panel instances to version 1.14.1 or later immediately.
  • Audit existing scheduled tasks within the Pterodactyl Panel to identify any unauthorized or suspicious commands initiated by subusers.
  • Review role-based access control (RBAC) configurations to ensure the 'schedule.update' permission is only assigned to trusted users until the patch is applied.
]]>highadvisory