Skip to content
Threat Feed
Subscribe

Tag

Pterodactyl

4 briefs RSS
low advisory

Pterodactyl Wings SFTP Service Denial of Service

An unauthenticated remote attacker can trigger a panic and crash the Pterodactyl Wings service by sending a maliciously crafted packet during the SFTP handshake.

wings denial-of-service pterodactyl go vulnerability
1t 1c
critical advisory

Pterodactyl Wings Configuration Secret Exposure via Egg Templating

The Pterodactyl Wings daemon improperly exposes its full configuration to the egg templating engine, allowing low-privileged users to exfiltrate sensitive node secrets, including daemon tokens and registry credentials, via crafted configuration placeholders.

Wings privilege-escalation authentication-bypass pterodactyl
1t 1c
high threat

Pterodactyl Wings Privilege Escalation via Improper JWT Scoping (CVE-2026-54593)

A privilege escalation vulnerability, CVE-2026-54593, exists in Pterodactyl's Wings component that allows authenticated subusers to upload arbitrary files to a server without explicit file creation permissions, due to insufficient validation of panel-signed JSON Web Tokens (JWTs.

Pterodactyl Panel +1 Unauthorized Subuser privilege-escalation vulnerability JWT Pterodactyl web-server
1r 1t
medium advisory

Pterodactyl Panel Global Rate-Limit Vulnerability Enables Unauthenticated DoS (CVE-2026-61609)

An unauthenticated attacker can exploit CVE-2026-61609, a global rate-limit vulnerability in Pterodactyl Panel versions up to and including 1.12.4, by sending approximately 10 requests per minute to authentication endpoints, leading to a panel-wide denial of service for all legitimate users and administrators attempting to log in or complete 2FA.

Panel denial-of-service vulnerability web-application pterodactyl
1r 2t