CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.
- Record
CVE-2026-54593- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-1259, CWE-1270
- Updated
- 2026-11-02
EUVDEUVD-2026-49880
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.
- Record
EUVD-2026-49880- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-8r6w-3qq5-4p4r
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Summary
A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing server_uuid, user_uuid, and unique_id, regardless of the token’s intended purpose. Because the Panel issues JWTs with these same claims for other lower-privilege operations (such as WebSocket authentication and file download links), an authenticated subuser can reuse one of those tokens to upload arbitrary files without possessing the required file.create permission.
Impact
Any subuser with permission to connect to a server's console, download files, or download backups could reuse those tokens to upload arbitrary files to the same server. A user that does not have access to a server as a subuser is not able to arbitrarily upload files.
Details
The panel generated JWT tokens for various purposes:
- https://github.com/pterodactyl/panel/blob/0f82c105201b192d229f6abd5827e2ee7e672a05/app/Services/Backups/DownloadLinkService.php#L33-L36
- https://github.com/pterodactyl/panel/blob/0f82c105201b192d229f6abd5827e2ee7e672a05/app/Http/Controllers/Api/Client/Servers/FileUploadController.php#L45
- https://github.com/pterodactyl/panel/blob/0f82c105201b192d229f6abd5827e2ee7e672a05/app/Http/Controllers/Api/Client/Servers/WebsocketController.php#L58-L61
- https://github.com/pterodactyl/panel/blob/0f82c105201b192d229f6abd5827e2ee7e672a05/app/Http/Controllers/Api/Client/Servers/FileController.php#L82-L85
Though as the actual purpose is not conveyed part of the JWT tokens, this introduces this vulnerability of being able to do non-intended actions due to the expected fields (i.e.
server_uuid) on most endpoints being the same when parsing it on wings' side.
PoC
Create a new subuser that has the minimal amount of permissions on a server (websocket.connect). As that subuser, retrieve a websocket JWT token from the GET /api/client/servers/[...]/websocket endpoint (in my case, I manually just make a request under that user's browser session; you can probably just resend the /websocket request in browser console to get a fresh unused token). Using that websocket token, we can abuse this by directly using it in the /upload/file endpoint of the wings node instead of using it for websocket authentication:
import requests
wings_url = 'http://[...]:8080'
websocket_token = '[...]'
res = requests.post(f'{wings_url}/upload/file', params = {
'token': websocket_token,
}, files = {
'files': ('file-upload.txt', b'Hello, World!'),
})
print(res.status_code, res.content)
Observe, that even though our subuser never has permissions outside viewing the console, they are able to write arbitrary files in the server. This pattern happens in a lot of other action, but this is probably the most interesting one.
- Record
GHSA-8r6w-3qq5-4p4r- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-1259, CWE-1270
- Updated
- 2026-11-02
NVD
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.
- Record
CVE-2026-54593- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-1259, CWE-1270
- Updated
- 2026-11-02
OSV
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.
- Record
CVE-2026-54593- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-1259, CWE-1270
- Updated
- 2026-11-02
OSVGHSA-8r6w-3qq5-4p4r
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
Summary
A privilege escalation vulnerability exists in the Wings /upload/file endpoint due to insufficient validation of panel-signed JWTs. Wings accepts any valid panel-signed JWT containing server_uuid, user_uuid, and unique_id, regardless of the token’s intended purpose. Because the Panel issues JWTs with these same claims for other lower-privilege operations (such as WebSocket authentication and file download links), an authenticated subuser can reuse one of those tokens to upload arbitrary files without possessing the required file.create permission.
Impact
Any subuser with permission to connect to a server's console, download files, or download backups could reuse those tokens to upload arbitrary files to the same server. A user that does not have access to a server as a subuser is not able to arbitrarily upload files.
Details
The panel generated JWT tokens for various purposes:
- https://github.com/pterodactyl/panel/blob/0f82c105201b192d229f6abd5827e2ee7e672a05/app/Services/Backups/DownloadLinkService.php#L33-L36
- https://github.com/pterodactyl/panel/blob/0f82c105201b192d229f6abd5827e2ee7e672a05/app/Http/Controllers/Api/Client/Servers/FileUploadController.php#L45
- https://github.com/pterodactyl/panel/blob/0f82c105201b192d229f6abd5827e2ee7e672a05/app/Http/Controllers/Api/Client/Servers/WebsocketController.php#L58-L61
- https://github.com/pterodactyl/panel/blob/0f82c105201b192d229f6abd5827e2ee7e672a05/app/Http/Controllers/Api/Client/Servers/FileController.php#L82-L85
Though as the actual purpose is not conveyed part of the JWT tokens, this introduces this vulnerability of being able to do non-intended actions due to the expected fields (i.e.
server_uuid) on most endpoints being the same when parsing it on wings' side.
PoC
Create a new subuser that has the minimal amount of permissions on a server (websocket.connect). As that subuser, retrieve a websocket JWT token from the GET /api/client/servers/[...]/websocket endpoint (in my case, I manually just make a request under that user's browser session; you can probably just resend the /websocket request in browser console to get a fresh unused token). Using that websocket token, we can abuse this by directly using it in the /upload/file endpoint of the wings node instead of using it for websocket authentication:
import requests
wings_url = 'http://[...]:8080'
websocket_token = '[...]'
res = requests.post(f'{wings_url}/upload/file', params = {
'token': websocket_token,
}, files = {
'files': ('file-upload.txt', b'Hello, World!'),
})
print(res.status_code, res.content)
Observe, that even though our subuser never has permissions outside viewing the console, they are able to write arbitrary files in the server. This pattern happens in a lot of other action, but this is probably the most interesting one.
- Record
GHSA-8r6w-3qq5-4p4r- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H - Weakness
- CWE-1259, CWE-1270
- Updated
- 2026-11-02
OSVGO-2026-6120 No score
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions in github.com/pterodactyl/wings
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted file.create permissions in github.com/pterodactyl/wings
- Record
GO-2026-6120- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:21761-1 No score
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues:
-
Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).
Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2026-5026 CVE-2026-39821
- GO-2026-6225
- GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
- GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
- GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
- GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
- GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
- GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
- GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
- GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
- GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
- GO-2026-6262 GHSA-22w5-2fxg-vrwx
- GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
- GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
- GO-2026-6265 GHSA-8fxq-53rx-ph5f
- GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
- GO-2026-6267 GHSA-h58c-xccx-75m3
- GO-2026-6268 GHSA-q9c5-pp7m-fm2g
- GO-2026-6269 GHSA-rxhg-vcww-2mpw
- GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
- GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
- GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
- GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
- GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
- GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
- GO-2026-6277 GHSA-4ph6-mjv7-3fq6
- GO-2026-6278 GHSA-w67g-5rqw-f597
- GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
- GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
- GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
- GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
- GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
- GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
- GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
- GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
- GO-2026-6287 GHSA-vx2m-jpxr-xv7w
- GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
- GO-2026-6289 GHSA-w8j7-39hp-8x59
- GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
- GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
- GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
- GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
- GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
- GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
- GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
- GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
- GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
- GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
- GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
- GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf
-
Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.
Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2026-4720 GHSA-v3mg-9v85-fcm7
- GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
- GO-2026-4950
- GO-2026-6093 GHSA-464c-974j-9xm6
- GO-2026-6094 GHSA-gcjh-h69q-9w9g
- GO-2026-6095 GHSA-r277-6w6q-xmqw
- GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
- GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
- GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
- GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
- GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
- GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
- GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
- GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
- GO-2026-6105 GHSA-c534-2w9c-x7fm
- GO-2026-6106 GHSA-v6w6-358x-2433
- GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
- GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
- GO-2026-6109 GHSA-86cx-wwf4-phq4
- GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
- GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
- GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
- GO-2026-6113 GHSA-p6ph-3jx2-3337
- GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
- GO-2026-6115 CVE-2026-56867
- GO-2026-6117 GHSA-hp74-gm6m-2qm5
- GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
- GO-2026-6119 CVE-2026-43983…
- Record
openSUSE-SU-2026:21761-1- Updated
- 2026-11-02
OSVSUSE-SU-2026:23625-1 No score
Security update for govulncheck-vulndb
This update for govulncheck-vulndb fixes the following issues:
-
Update to version 0.0.20260827T195228 2026-08-27T19:52:28Z (jsc#PED-11136).
Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2026-5026 CVE-2026-39821
- GO-2026-6225
- GO-2026-6250 CVE-2026-63328 GHSA-8rc5-4fr6-64pw
- GO-2026-6253 CVE-2026-17106 GHSA-hfg8-hc9c-6c3h
- GO-2026-6254 CVE-2026-53941 GHSA-vjhx-2cqw-3q6q
- GO-2026-6255 CVE-2026-61711 GHSA-7236-3392-c5c6
- GO-2026-6256 CVE-2026-61712 GHSA-72x6-4j93-7w86
- GO-2026-6258 CVE-2026-45404 GHSA-42cj-99w8-cp2p
- GO-2026-6259 CVE-2026-32637 GHSA-j2g6-362q-6qc6
- GO-2026-6260 CVE-2026-55149 GHSA-qqff-5854-px68
- GO-2026-6261 CVE-2026-54061 GHSA-rrwh-6jrq-wp5v
- GO-2026-6262 GHSA-22w5-2fxg-vrwx
- GO-2026-6263 CVE-2026-54168 GHSA-6f2p-296r-cc28
- GO-2026-6264 CVE-2026-54245 GHSA-7q96-f8xw-jv5j
- GO-2026-6265 GHSA-8fxq-53rx-ph5f
- GO-2026-6266 CVE-2026-54167 GHSA-f5f4-3hh4-f54m
- GO-2026-6267 GHSA-h58c-xccx-75m3
- GO-2026-6268 GHSA-q9c5-pp7m-fm2g
- GO-2026-6269 GHSA-rxhg-vcww-2mpw
- GO-2026-6270 CVE-2026-54162 GHSA-x3g7-qrwc-f6c5
- GO-2026-6271 CVE-2026-67448 GHSA-8r62-w5wh-fc5m
- GO-2026-6272 CVE-2026-67447 GHSA-r553-m4fv-5v97
- GO-2026-6273 CVE-2026-64679 GHSA-26w5-6g95-gj28
- GO-2026-6274 CVE-2026-76905 GHSA-mmfr-pmjx-hw9w
- GO-2026-6275 CVE-2026-77354 GHSA-xhj3-7xw9-vr34
- GO-2026-6277 GHSA-4ph6-mjv7-3fq6
- GO-2026-6278 GHSA-w67g-5rqw-f597
- GO-2026-6279 CVE-2026-6046 GHSA-3vmp-whvv-5v9v
- GO-2026-6280 CVE-2026-7387 GHSA-6hxm-w4hv-vgvw
- GO-2026-6281 CVE-2026-6961 GHSA-8qq9-cqj8-82w4
- GO-2026-6282 CVE-2026-7184 GHSA-9p44-r552-4wp9
- GO-2026-6283 CVE-2026-6689 GHSA-c28q-m4gf-vg4q
- GO-2026-6284 CVE-2026-55477 GHSA-jm48-m3rr-9hgg
- GO-2026-6285 CVE-2026-6739 GHSA-m2w9-h2mm-79qr
- GO-2026-6286 CVE-2026-3433 GHSA-rp4v-qc77-phm4
- GO-2026-6287 GHSA-vx2m-jpxr-xv7w
- GO-2026-6288 CVE-2026-11624 GHSA-76g7-m3xw-x9gr
- GO-2026-6289 GHSA-w8j7-39hp-8x59
- GO-2026-6290 CVE-2026-55581 GHSA-3x77-wg38-92r3
- GO-2026-6291 CVE-2026-55582 GHSA-74hp-mggr-hv58
- GO-2026-6292 CVE-2026-55580 GHSA-f5pj-2738-996m
- GO-2026-6293 CVE-2026-55677 GHSA-vfp3-v2gw-7wfq
- GO-2026-6294 CVE-2026-55092 GHSA-mcj4-mphf-j9ff
- GO-2026-6295 CVE-2026-55637 GHSA-cmwv-wf9p-p8wx
- GO-2026-6296 CVE-2026-54523 GHSA-79gf-7frw-68m9
- GO-2026-6297 CVE-2026-50879 GHSA-g743-m6x3-v6wm
- GO-2026-6298 CVE-2026-54563 GHSA-w5fv-7x5q-g8qp
- GO-2026-6299 CVE-2026-50884 GHSA-5442-mh7f-72px
- GO-2026-6300 CVE-2026-50891 GHSA-rcqf-cpv9-g5jf
- GO-2026-6301 CVE-2026-42350 GHSA-g7gw-m874-7rmf
-
Update to version 0.0.20260819T170606 2026-08-19T17:06:06Z.
Go CVE Numbering Authority IDs added or updated with aliases:
- GO-2026-4720 GHSA-v3mg-9v85-fcm7
- GO-2026-4942 CVE-2026-35172 GHSA-f2g3-hh2r-cwgc
- GO-2026-4950
- GO-2026-6093 GHSA-464c-974j-9xm6
- GO-2026-6094 GHSA-gcjh-h69q-9w9g
- GO-2026-6095 GHSA-r277-6w6q-xmqw
- GO-2026-6097 CVE-2026-55495 GHSA-49h3-cwhj-4737
- GO-2026-6098 CVE-2026-55496 GHSA-8r7f-r8hj-r3rv
- GO-2026-6099 CVE-2026-57497 GHSA-g35j-m5xg-vh3q
- GO-2026-6100 CVE-2026-55497 GHSA-g9j2-8w95-3vwv
- GO-2026-6101 CVE-2026-55502 GHSA-hq88-5x99-x3gf
- GO-2026-6102 CVE-2026-55499 GHSA-w8x7-h2px-xmq8
- GO-2026-6103 CVE-2026-73564 GHSA-26gq-p25f-99cp
- GO-2026-6104 CVE-2026-62323 GHSA-c3jm-gv5r-9wcp
- GO-2026-6105 GHSA-c534-2w9c-x7fm
- GO-2026-6106 GHSA-v6w6-358x-2433
- GO-2026-6107 CVE-2026-73500 GHSA-6vch-q96h-7gc3
- GO-2026-6108 CVE-2026-73505 GHSA-6xj8-qv9j-xcjq
- GO-2026-6109 GHSA-86cx-wwf4-phq4
- GO-2026-6110 CVE-2026-73509 GHSA-95cv-r8x4-vh75
- GO-2026-6111 CVE-2026-73506 GHSA-fwjx-9p69-h25h
- GO-2026-6112 CVE-2026-73502 GHSA-jpcw-4wr7-c3vq
- GO-2026-6113 GHSA-p6ph-3jx2-3337
- GO-2026-6114 CVE-2026-73499 GHSA-xg4h-6gfc-h4m8
- GO-2026-6115 CVE-2026-56867
- GO-2026-6117 GHSA-hp74-gm6m-2qm5
- GO-2026-6118 CVE-2026-47427 GHSA-w4q6-qw23-4rg7
- GO-2026-6119 CVE-2026-43983…
- Record
SUSE-SU-2026:23625-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pterodactyl/panelPackagist |
before 1.12.3 | 1.12.3 |
github.com/pterodactyl/wingsGo |
before 1.12.2 | 1.12.2 |
pterodactyl/panelPackagist |
before 1.12.3, plus listed versions v0.1.0-betav0.1.1-betav0.1.2-betav0.2.0-betav0.3.0-beta Show 45 moreShow lessv0.4.0-betav0.4.1-betav0.5.0v0.5.0-rc.1v0.5.0-rc.2v0.5.1v0.5.2v0.5.3v0.5.4v0.5.5v0.5.6v0.5.7v0.6.0v0.6.0-beta.1v0.6.0-beta.2v0.6.0-beta.2.1v0.6.0-rc.1v0.6.1v0.6.2v0.6.3v0.6.4v0.7.0v0.7.0-beta.1v0.7.0-beta.2v0.7.0-beta.3v0.7.0-beta.4v0.7.0-rc.1v0.7.0-rc.2v0.7.1v0.7.10v0.7.11v0.7.12v0.7.13v0.7.14v0.7.15v0.7.16v0.7.17v0.7.18v0.7.19v0.7.2v0.7.3v0.7.4v0.7.5v0.7.6v0.7.7 |
1.12.3 |
govulncheck-vulndbSUSE:Linux Enterprise Server 16.0 |
before 0.0.20260827T195228-160000.1.1 | 0.0.20260827T195228-160000.1.1 |
govulncheck-vulndbSUSE:Linux Enterprise Server for SAP applications 16.0 |
before 0.0.20260827T195228-160000.1.1 | 0.0.20260827T195228-160000.1.1 |
govulncheck-vulndbopenSUSE:Leap 16.0 |
before 0.0.20260827T195228-160000.1.1 | 0.0.20260827T195228-160000.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-54593 is a high vulnerability (CVSS 8.1) in Convoypanel Panel, published July 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.68%, the 52nd percentile. Fixed in pterodactyl/panel 1.12.3.
References
github.com/pterodactyl/panel/security/advisories/GHSA-8r6w-3qq5-4p4r
Show 184 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-54593
suse.com/support/update/announcement/2026/suse-su-202623625-1
Left out here: 71 versions and the rest of 2 source descriptions. The JSON record has them.