Pterodactyl Panel vulnerabilities

• convoypanel panel Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks CVE-2026-86177 8.7 HighSeptember 5, 2026
• convoypanel panel Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions CVE-2026-54593 Fix available 8.1 HighJuly 28, 2026
• convoypanel panel Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) CVE-2026-61609 Fix available 7.5 HighJuly 28, 2026
• convoypanel panel Pterodactyl has a database resource limit bypass via race condition in Client API CVE-2026-35202 Fix available 2.3 LowMay 26, 2026
• convoypanel panel Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization CVE-2026-26016 Fix available 9.2 CriticalFebruary 17, 2026
• convoypanel panel, pterodactyl wings +1 more Pterodactyl Wings's websocket endpoints have no visible rate limits or monitoring, allowing for DOS attacks under certain circumstances CVE-2025-69199 Fix available 8.3 HighJanuary 19, 2026
• convoypanel panel Pterodactyl's improper resource locking allows raced queries to create more resources than alloted CVE-2025-69198 Fix available 6.0 MediumJanuary 19, 2026
• convoypanel panel Pterodactyl TOTPs can be reused during validity window CVE-2025-69197 Fix available 6.5 MediumJanuary 6, 2026
• convoypanel panel, pterodactyl wings +1 more Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced CVE-2025-68954 Fix available 7.5 HighJanuary 6, 2026
• convoypanel panel Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution CVE-2025-49132 Public exploitFix available EPSS 54.5% 10.0 CriticalJune 19, 2025
• convoypanel panel Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled CVE-2024-49762 Fix available 4.6 MediumOctober 24, 2024
• convoypanel panel Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel CVE-2024-34067 Fix available 6.1 MediumMay 3, 2024
• convoypanel panel Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys CVE-2021-41273 Fix available 4.3 MediumNovember 17, 2021
• convoypanel panel logout CSRF in Pterodactyl Panel CVE-2021-41176 Fix available 4.3 MediumOctober 25, 2021
• convoypanel panel Authentication bypass in Pterodactyl CVE-2021-41129 Fix available 8.1 HighOctober 4, 2021
• pterodactyl panel Pterodactyl vulnerable to 2FA Sniffing CVE-2019-1020002 Fix available 7.5 HighJuly 29, 2019