Skip to content
Threat Feed
Subscribe

Product

Pterodactyl Wings (< 1.12.2)

1 brief RSS
high threat

Pterodactyl Wings Privilege Escalation via Improper JWT Scoping (CVE-2026-54593)

A privilege escalation vulnerability, CVE-2026-54593, exists in Pterodactyl's Wings component that allows authenticated subusers to upload arbitrary files to a server without explicit file creation permissions, due to insufficient validation of panel-signed JSON Web Tokens (JWTs.

Pterodactyl Panel +1 Unauthorized Subuser privilege-escalation vulnerability JWT Pterodactyl web-server
1r 1t