CVE-2026-86177highCWE-862

CVE-2026-86177: falha de alta gravidade em pterodactyl panel

Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar panel

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

41Vexday Risk Score

Sem sinal de exploração. Ela tem prova de conceito pública.

ssvc Attendcvss 8.7epss 0.6%
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
pterodactyl · panel
⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
CVEs relacionadas — pterodactyl panel

No mesmo produto, das mais perigosas para as menos.

CVE-2025-49132CRITICALPterodactyl Panel Allows Unauthenticated Arbitrary Remote Code ExecutionEPSS 54.5%CVE-2021-41129HIGHAuthentication bypass in PterodactylEPSS 1.8%CVE-2026-54593HIGHPterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissionsEPSS 0.7%CVE-2021-41176MEDIUMlogout CSRF in Pterodactyl PanelEPSS 0.5%CVE-2026-61609HIGHPterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)EPSS 0.5%CVE-2024-34067MEDIUMMultiple cross site scripting (XSS) vulnerabilities in the admin area of Pterodactyl panelEPSS 0.5%