PT-2026-20331 · Wings+1 · Wings+3
Duddnr0615K
·
Published
2026-02-17
·
Updated
2026-02-23
·
CVE-2026-26016
CVSS v4.0
9.2
Critical
| Vector | AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L |
Name of the Vulnerable Software and Affected Versions
Pterodactyl Panel versions prior to 1.12.1
Description
A missing authorization check allows any user with access to a node secret token to fetch information about any server on a Pterodactyl instance, even if that server is associated with a different node. This issue stems from missing logic to verify that the node requesting server data is the same node that the server is associated with. Authenticated Wings nodes can retrieve server installation scripts (potentially containing secret values) and manipulate the installation status of servers belonging to other nodes. Wings nodes may also manipulate the transfer status of servers belonging to other nodes. The Remote API endpoint
/api/remote/servers/{uuid} fetches a server by UUID and returns its complete configuration without verifying that the requesting node owns the server. The failure() and success() methods in ServerTransferController fetch servers by UUID without verifying node ownership. Missing authorization checks in ServerInstallController allow any authenticated Wings node to retrieve egg installation scripts (containing deployment secrets) and manipulate the installation status of servers belonging to other nodes. A compromised Wings node daemon token grants access to sensitive configuration data of every server on the panel, rather than only to servers that the node has access to. Triggering a false transfer success causes the panel to delete the server from the source node, resulting in permanent data loss.Recommendations
Update to version 1.12.1 or later.
Exploit
Fix
IDOR
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Pterodactyl Panel
Serverinstallcontroller
Servertransfercontroller
Wings