CVE-2026-86177highCWE-862

CVE-2026-86177: high-severity vulnerability in pterodactyl panel

Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

Published · Updated

Follow this CVE+ Monitor panel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

41Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 8.7epss 0.6%
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
pterodactyl · panel
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — pterodactyl panel

In the same product, most dangerous first.

CVE-2025-49132CRITICALPterodactyl Panel Allows Unauthenticated Arbitrary Remote Code ExecutionEPSS 54.5%CVE-2021-41129HIGHAuthentication bypass in PterodactylEPSS 1.8%CVE-2026-54593HIGHPterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsEPSS 0.7%CVE-2021-41176MEDIUMlogout CSRF in Pterodactyl PanelEPSS 0.5%CVE-2026-61609HIGHPterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)EPSS 0.5%CVE-2024-34067MEDIUMMultiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panelEPSS 0.5%