CVE-2026-35202
Pterodactyl has a database resource limit bypass via race condition in Client API
Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Pterodactyl has a database resource limit bypass via race condition in Client API
Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.
- Record
CVE-2026-35202- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-367, CWE-770
- Updated
- 2026-11-02
EUVDEUVD-2026-34010
Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.
- Record
EUVD-2026-34010- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-fgmm-w5cx-vrfw
Pterodactyl has a database resource limit bypass via race condition in Client API
Summary
The Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything.
Details
Inside DatabaseController.php, the code tries to prevent multiple databases from being created at once by calling $server->databases()->lockForUpdate(). In Laravel, this just configures a query builder but never actually sends a command to the database because it’s missing a terminal method like count() or get(). It’s basically a no-op that does nothing.
Since there’s no real lock, multiple requests hitting the endpoint at the exact same time will all see that the database count is under the limit. They all move forward to the DeployServerDatabaseService and successfully create extra resources on the physical host.
Impact
Users are able to create more databases than they are supposed to, potentially also breaking the web interface.
- Record
GHSA-fgmm-w5cx-vrfw- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-367, CWE-770
- Updated
- 2026-11-02
NVD
Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.
- Record
CVE-2026-35202- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-367, CWE-770
- Updated
- 2026-11-02
OSV
Pterodactyl has a database resource limit bypass via race condition in Client API
Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.
- Record
CVE-2026-35202- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-367, CWE-770
- Updated
- 2026-11-02
OSVGHSA-fgmm-w5cx-vrfw
Pterodactyl has a database resource limit bypass via race condition in Client API
Summary
The Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything.
Details
Inside DatabaseController.php, the code tries to prevent multiple databases from being created at once by calling $server->databases()->lockForUpdate(). In Laravel, this just configures a query builder but never actually sends a command to the database because it’s missing a terminal method like count() or get(). It’s basically a no-op that does nothing.
Since there’s no real lock, multiple requests hitting the endpoint at the exact same time will all see that the database count is under the limit. They all move forward to the DeployServerDatabaseService and successfully create extra resources on the physical host.
Impact
Users are able to create more databases than they are supposed to, potentially also breaking the web interface.
- Record
GHSA-fgmm-w5cx-vrfw- CVSS 4.0
- 2.3 Low
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-367, CWE-770
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pterodactyl/panelPackagist |
before 1.12.3 | 1.12.3 |
pterodactyl/panelPackagist |
before 1.12.3, plus listed versions v0.1.0-betav0.1.1-betav0.1.2-betav0.2.0-betav0.3.0-beta Show 45 moreShow lessv0.4.0-betav0.4.1-betav0.5.0v0.5.0-rc.1v0.5.0-rc.2v0.5.1v0.5.2v0.5.3v0.5.4v0.5.5v0.5.6v0.5.7v0.6.0v0.6.0-beta.1v0.6.0-beta.2v0.6.0-beta.2.1v0.6.0-rc.1v0.6.1v0.6.2v0.6.3v0.6.4v0.7.0v0.7.0-beta.1v0.7.0-beta.2v0.7.0-beta.3v0.7.0-beta.4v0.7.0-rc.1v0.7.0-rc.2v0.7.1v0.7.10v0.7.11v0.7.12v0.7.13v0.7.14v0.7.15v0.7.16v0.7.17v0.7.18v0.7.19v0.7.2v0.7.3v0.7.4v0.7.5v0.7.6v0.7.7 |
1.12.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-35202 is a low vulnerability (CVSS 2.3) in Convoypanel Panel, published May 26, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 11th percentile. Fixed in pterodactyl/panel 1.12.3.
References
Left out here: 71 versions. The JSON record has them.