Skip to content
Pterodactyl vulnerabilities
Newest
-
convoypanel panel
Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
CVE-2026-86177
8.7 High
-
pterodactyl wings
Pterodactyl Wings SFTP write path does not enforce disk quota, allowing node-wide disk exhaustion
CVE-2026-61617
7.7 High
-
pterodactyl wings
Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service
CVE-2026-52856
Public exploitFix available
7.5 High
-
pterodactyl wings
Wings exposes node configuration secrets through egg configuration-file templating
CVE-2026-52855
Fix available
9.9 Critical
-
pterodactyl wings
Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM
CVE-2026-52857
Fix available
5.5 Medium
-
convoypanel panel
Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions
CVE-2026-54593
Fix available
8.1 High
-
convoypanel panel
Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)
CVE-2026-61609
Fix available
7.5 High
-
convoypanel panel
Pterodactyl has a database resource limit bypass via race condition in Client API
CVE-2026-35202
Fix available
2.3 Low
-
convoypanel panel
Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
CVE-2026-26016
Fix available
9.2 Critical
-
pterodactyl wings
Endless reprocessing/reupload of activity log data due to SQLite max parameters limit not being considered
CVE-2026-21696
Fix available
8.3 High
-
convoypanel panel, pterodactyl wings +1 more
Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances
CVE-2025-69199
Fix available
8.3 High
-
convoypanel panel
Pterodactyl's improper resource locking allows raced queries to create more resources than alloted
CVE-2025-69198
Fix available
6.0 Medium
-
convoypanel panel
Pterodactyl TOTPs can be reused during validity window
CVE-2025-69197
Fix available
6.5 Medium
-
convoypanel panel, pterodactyl wings +1 more
Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
CVE-2025-68954
Fix available
7.5 High
-
convoypanel panel
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
CVE-2025-49132
Public exploitFix available
EPSS 54.5%
10.0 Critical
-
convoypanel panel
Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled
CVE-2024-49762
Fix available
4.6 Medium
-
pterodactyl wings
Arbitrary File Write/Read in Pterodactyl wings
CVE-2024-34066
Fix available
8.5 High
-
convoypanel panel
Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel
CVE-2024-34067
Fix available
6.1 Medium
-
pterodactyl wings
Server-side Request Forgery during remote file pull in Pterodactyl wings
CVE-2024-34068
Fix available
6.4 Medium
-
pterodactyl wings
Improper isolation of server file access in github.com/pterodactyl/wings
CVE-2024-27102
Fix available
10.0 Critical
-
pterodactyl wings
Wings vulnerable to escape to host from installation container
CVE-2023-32080
Fix available
9.1 Critical
-
pterodactyl wings
Symbolic Link (Symlink) Following allowing the deletion of files and directories on the host system in wings
CVE-2023-25168
Fix available
9.6 Critical
-
pterodactyl wings
Symbolic Link (Symlink) Following in github.com/pterodactyl/wings
CVE-2023-25152
Fix available
8.4 High
-
convoypanel panel
Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys
CVE-2021-41273
Fix available
4.3 Medium
-
convoypanel panel
logout CSRF in Pterodactyl Panel
CVE-2021-41176
Fix available
4.3 Medium
-
convoypanel panel
Authentication bypass in Pterodactyl
CVE-2021-41129
Fix available
8.1 High
-
pterodactyl wings
Asymmetric Resource Consumption (Amplification) in Docker containers created by Wings
CVE-2021-32699
Fix available
6.5 Medium
-
pterodactyl panel
Pterodactyl vulnerable to 2FA Sniffing
CVE-2019-1020002
Fix available
7.5 High