Skip to content
Threat Feed
Subscribe

Tag

Pterodactyl

2 briefs RSS
high threat

Pterodactyl Wings Privilege Escalation via Improper JWT Scoping (CVE-2026-54593)

A privilege escalation vulnerability, CVE-2026-54593, exists in Pterodactyl's Wings component that allows authenticated subusers to upload arbitrary files to a server without explicit file creation permissions, due to insufficient validation of panel-signed JSON Web Tokens (JWTs.

Pterodactyl Panel +1 Unauthorized Subuser privilege-escalation vulnerability JWT Pterodactyl web-server
1r 1t
medium advisory

Pterodactyl Panel Global Rate-Limit Vulnerability Enables Unauthenticated DoS (CVE-2026-61609)

An unauthenticated attacker can exploit CVE-2026-61609, a global rate-limit vulnerability in Pterodactyl Panel versions up to and including 1.12.4, by sending approximately 10 requests per minute to authentication endpoints, leading to a panel-wide denial of service for all legitimate users and administrators attempting to log in or complete 2FA.

Panel denial-of-service vulnerability web-application pterodactyl
1r 2t