What’s Vulnerable › Products

pterodactyl panel vulnerabilities

15 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.

Check whether your pterodactyl panel version is affected

Latest pterodactyl panel vulnerabilities

• CVE-2026-86177 — Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks (CVSS 8.8)
• CVE-2026-61609 — Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS) (CVSS 7.5)
• CVE-2026-54593 — Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions (CVSS 8.1)
• CVE-2026-35202 — Pterodactyl has a database resource limit bypass via race condition in Client API (CVSS 2.3)
• CVE-2026-26016 — Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization (CVSS 8.1)
• CVE-2025-69198 — Pterodactyl's improper resource locking allows raced queries to create more resources than alloted (CVSS 6.5)
• CVE-2025-69197 — Pterodactyl TOTPs can be reused during validity window (CVSS 6.5)
• CVE-2025-68954 — Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced (CVSS 5.4)
• CVE-2025-49132 — Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution (CVSS 10.0)
• CVE-2024-49762 — Pterodactyl Panel has plain-text logging of user passwords when two-factor authentication is disabled (CVSS 4.6)
• CVE-2024-34067 — Multiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panel (CVSS 6.1)
• CVE-2021-41273 — Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys (CVSS 4.3)
• CVE-2021-41176 — logout CSRF in Pterodactyl Panel (CVSS 4.3)
• CVE-2021-41129 — Authentication bypass in Pterodactyl (CVSS 6.8)
• CVE-2019-1020002 — (CVSS 7.5)