PT-2026-3490 · Pterodactyl · Wings

Danny6167 · Publicado 2026-01-19 · Atualizado 2026-02-06 · CVE-2026-21696

Positive Technologies (AI Summary)

CVSS v4.0

8.3

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions Wings versions 1.7.0 through 1.11.9

Description Wings, the server control plane for Pterodactyl, is affected by an issue where it does not account for SQLite’s maximum parameter limit when handling activity log entries. This allows a low-privileged user to cause the panel to be flooded with activity records. The system attempts to delete activity entries from the SQLite database in a single query, exceeding the limit of 32766 parameters. This results in an error, preventing the deletion of entries, which are then repeatedly re-processed and sent to the panel. An attacker can exploit this to repeatedly upload the same activity data to the panel, potentially exhausting the database server’s disk space.

Recommendations Update to Wings version 1.12.0 or later.

Exploit

Correção

Resource Exhaustion

Allocation of Resources Without Limits

Enumeração de Fraquezas

CWE-400

CWE-770

Identificadores relacionados

CVE-2026-21696

GHSA-2497-GP99-2M74

GO-2026-4329

SUSE-SU-2026:0403-1

Produtos afetados

Wings

Referências · 91

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21696.json · Exploit
• https://github.com/pterodactyl/panel/releases/tag/v1.12.0 · Nota
• https://github.com/pterodactyl/panel/commit/09caa0d4995bd924b53b9a9e9b4883ac27bd5607 · Nota
• https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/activity_cron.go#L81 · Nota
• https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/sftp_cron.go#L86 · Nota
• https://github.com/pterodactyl/wings/security/advisories/GHSA-2497-gp99-2m74 · Aviso do Fabricante
• https://github.com/pterodactyl/wings · Nota
• https://suse.com/security/cve/CVE-2026-24117 · Nota
• https://suse.com/security/cve/CVE-2023-43630 · Nota
• https://suse.com/security/cve/CVE-2026-23954 · Nota
• https://suse.com/security/cve/CVE-2026-24740 · Nota
• https://osv.dev/vulnerability/GO-2026-4329 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2026-25499 · Nota
• https://suse.com/security/cve/CVE-2026-23517 · Nota
• https://suse.com/security/cve/CVE-2026-24844 · Nota