PT-2026-3490 · Pterodactyl · Wings

Danny6167 · Published 2026-01-19 · Updated 2026-02-06 · CVE-2026-21696

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Name of the Vulnerable Software and Affected Versions Wings versions 1.7.0 through 1.11.9

Description Wings, the server control plane for Pterodactyl, is affected by an issue where it does not account for SQLite’s maximum parameter limit when handling activity log entries. This allows a low-privileged user to cause the panel to be flooded with activity records. The system attempts to delete activity entries from the SQLite database in a single query, exceeding the limit of 32766 parameters. This results in an error, preventing the deletion of entries, which are then repeatedly re-processed and sent to the panel. An attacker can exploit this to repeatedly upload the same activity data to the panel, potentially exhausting the database server’s disk space.

Recommendations Update to Wings version 1.12.0 or later.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

CVE-2026-21696

GHSA-2497-GP99-2M74

GO-2026-4329

SUSE-SU-2026:0403-1

Affected Products

Wings

References · 91

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21696.json · Exploit
• https://github.com/pterodactyl/wings/security/advisories/GHSA-2497-gp99-2m74 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4329 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21696 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0403-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-21696 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2497-gp99-2m74 · Vendor Advisory
• https://github.com/pterodactyl/panel/releases/tag/v1.12.0 · Note
• https://github.com/pterodactyl/panel/commit/09caa0d4995bd924b53b9a9e9b4883ac27bd5607 · Note
• https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/activity_cron.go#L81 · Note
• https://github.com/pterodactyl/wings/blob/9ffbcdcdb1163da823cf9959b9602df9f7dcb54a/internal/cron/sftp_cron.go#L86 · Note
• https://github.com/pterodactyl/wings · Note
• https://suse.com/security/cve/CVE-2026-24117 · Note
• https://suse.com/security/cve/CVE-2023-43630 · Note
• https://suse.com/security/cve/CVE-2026-23954 · Note