CVE-2026-26016

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-26016", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-02-09T21:36:29.554Z", "datePublished": "2026-02-19T15:55:20.064Z", "dateUpdated": "2026-02-20T15:42:39.382Z"}, "containers": {"cna": {"title": "Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization", "problemTypes": [{"descriptions": [{"cweId": "CWE-639", "lang": "en", "description": "CWE-639: Authorization Bypass Through User-Controlled Key", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-283", "lang": "en", "description": "CWE-283: Unverified Ownership", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "baseScore": 9.2, "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728"}, {"name": "https://github.com/pterodactyl/panel/releases/tag/v1.12.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/pterodactyl/panel/releases/tag/v1.12.1"}], "affected": [{"vendor": "pterodactyl", "product": "panel", "versions": [{"version": "< 1.12.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T15:55:20.064Z"}, "descriptions": [{"lang": "en", "value": "Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about any server on a Pterodactyl instance, even if that server is associated with a different node. This issue stems from missing logic to verify that the node requesting server data is the same node that the server is associated with. Any authenticated Wings node can retrieve server installation scripts (potentially containing secret values) and manipulate the installation status of servers belonging to other nodes. Wings nodes may also manipulate the transfer status of servers belonging to other nodes. This vulnerability requires a user to acquire a secret access token for a node. Unless a user gains access to a Wings secret access token they would not be able to access any of these vulnerable endpoints, as every endpoint requires a valid node access token. A single compromised Wings node daemon token (stored in plaintext at `/etc/pterodactyl/config.yml`) grants access to sensitive configuration data of every server on the panel, rather than only to servers that the node has access to. An attacker can use this information to move laterally through the system, send excessive notifications, destroy server data on other nodes, and otherwise exfiltrate secrets that they should not have access to with only a node token. Additionally, triggering a false transfer success causes the panel to delete the server from the source node, resulting in permanent data loss. Users should upgrade to version 1.12.1 to receive a fix."}], "source": {"advisory": "GHSA-g7vw-f8p5-c728", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-20T15:29:43.066378Z", "id": "CVE-2026-26016", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:42:39.382Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-26016", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-20T15:29:43.066378Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-20T15:29:44.516Z"}}], "cna": {"title": "Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization", "source": {"advisory": "GHSA-g7vw-f8p5-c728", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 9.2, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "pterodactyl", "product": "panel", "versions": [{"status": "affected", "version": "< 1.12.1"}]}], "references": [{"url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728", "name": "https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/pterodactyl/panel/releases/tag/v1.12.1", "name": "https://github.com/pterodactyl/panel/releases/tag/v1.12.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about any server on a Pterodactyl instance, even if that server is associated with a different node. This issue stems from missing logic to verify that the node requesting server data is the same node that the server is associated with. Any authenticated Wings node can retrieve server installation scripts (potentially containing secret values) and manipulate the installation status of servers belonging to other nodes. Wings nodes may also manipulate the transfer status of servers belonging to other nodes. This vulnerability requires a user to acquire a secret access token for a node. Unless a user gains access to a Wings secret access token they would not be able to access any of these vulnerable endpoints, as every endpoint requires a valid node access token. A single compromised Wings node daemon token (stored in plaintext at `/etc/pterodactyl/config.yml`) grants access to sensitive configuration data of every server on the panel, rather than only to servers that the node has access to. An attacker can use this information to move laterally through the system, send excessive notifications, destroy server data on other nodes, and otherwise exfiltrate secrets that they should not have access to with only a node token. Additionally, triggering a false transfer success causes the panel to delete the server from the source node, resulting in permanent data loss. Users should upgrade to version 1.12.1 to receive a fix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639: Authorization Bypass Through User-Controlled Key"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-283", "description": "CWE-283: Unverified Ownership"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T15:55:20.064Z"}}}, "cveMetadata": {"cveId": "CVE-2026-26016", "state": "PUBLISHED", "dateUpdated": "2026-02-20T15:42:39.382Z", "dateReserved": "2026-02-09T21:36:29.554Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-19T15:55:20.064Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "panel", "vendor": "pterodactyl", "versions": [{"status": "affected", "version": "< 1.12.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:pterodactyl:panel:*:*:*:*:*:*:*:*", "matchCriteriaId": "57849D30-EFC2-47CA-9018-240B563977DC", "versionEndExcluding": "1.12.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about any server on a Pterodactyl instance, even if that server is associated with a different node. This issue stems from missing logic to verify that the node requesting server data is the same node that the server is associated with. Any authenticated Wings node can retrieve server installation scripts (potentially containing secret values) and manipulate the installation status of servers belonging to other nodes. Wings nodes may also manipulate the transfer status of servers belonging to other nodes. This vulnerability requires a user to acquire a secret access token for a node. Unless a user gains access to a Wings secret access token they would not be able to access any of these vulnerable endpoints, as every endpoint requires a valid node access token. A single compromised Wings node daemon token (stored in plaintext at `/etc/pterodactyl/config.yml`) grants access to sensitive configuration data of every server on the panel, rather than only to servers that the node has access to. An attacker can use this information to move laterally through the system, send excessive notifications, destroy server data on other nodes, and otherwise exfiltrate secrets that they should not have access to with only a node token. Additionally, triggering a false transfer success causes the panel to delete the server from the source node, resulting in permanent data loss. Users should upgrade to version 1.12.1 to receive a fix."}, {"lang": "es", "value": "Wings es el plano de control del servidor para Pterodactyl, un panel de gesti\u00f3n de servidores de juegos gratuito y de c\u00f3digo abierto. Antes de la versi\u00f3n 1.12.1, una falta de verificaci\u00f3n de autorizaci\u00f3n en m\u00faltiples controladores permite a cualquier usuario con acceso a un token secreto de nodo obtener informaci\u00f3n sobre cualquier servidor en una instancia de Pterodactyl, incluso si ese servidor est\u00e1 asociado con un nodo diferente. Este problema se deriva de la falta de l\u00f3gica para verificar que el nodo que solicita datos del servidor es el mismo nodo con el que est\u00e1 asociado el servidor. Cualquier nodo Wings autenticado puede recuperar scripts de instalaci\u00f3n de servidores (que potencialmente contienen valores secretos) y manipular el estado de instalaci\u00f3n de servidores pertenecientes a otros nodos. Los nodos Wings tambi\u00e9n pueden manipular el estado de transferencia de servidores pertenecientes a otros nodos. Esta vulnerabilidad requiere que un usuario adquiera un token de acceso secreto para un nodo. A menos que un usuario obtenga acceso a un token de acceso secreto de Wings, no podr\u00eda acceder a ninguno de estos puntos finales vulnerables, ya que cada punto final requiere un token de acceso de nodo v\u00e1lido. Un \u00fanico token de demonio de nodo Wings comprometido (almacenado en texto plano en '/etc/pterodactyl/config.yml') otorga acceso a datos de configuraci\u00f3n sensibles de cada servidor en el panel, en lugar de solo a los servidores a los que el nodo tiene acceso. Un atacante puede usar esta informaci\u00f3n para moverse lateralmente a trav\u00e9s del sistema, enviar notificaciones excesivas, destruir datos de servidores en otros nodos y, de otro modo, exfiltrar secretos a los que no deber\u00eda tener acceso con solo un token de nodo. Adem\u00e1s, activar un \u00e9xito de transferencia falso hace que el panel elimine el servidor del nodo de origen, lo que resulta en una p\u00e9rdida permanente de datos. Los usuarios deben actualizar a la versi\u00f3n 1.12.1 para recibir una soluci\u00f3n."}], "id": "CVE-2026-26016", "lastModified": "2026-06-17T10:25:36.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.2, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-26016", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-20T15:29:43.066378Z", "version": "2.0.3"}}]}, "published": "2026-02-19T17:24:50.293", "references": [{"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/pterodactyl/panel/releases/tag/v1.12.1"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-283"}, {"lang": "en", "value": "CWE-639"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.12.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "panel", "source": "cna", "vendor": "pterodactyl"}, "product": "panel", "vendor": "pterodactyl"}], "analysis": {"en": {"generated_at": "2026-04-17T18:03:58.865965+00:00", "value": {"mitigation_remediation": ["Upgrade Pterodactyl to version 1.12.1 or later to apply the vendor\u2019s fix for the missing authorization checks.", "Secure the node secret token by restricting filesystem permissions to the Wire daemon only and consider encrypting or rotating the token on a regular basis.", "Limit network exposure of the Wings API by configuring firewall rules or a reverse proxy that permits traffic only from trusted node host addresses and blocks direct public access."], "summary": {"action": "Immediate Patch", "impact": "Remote Data Exposure and Lateral Access"}, "threat_synthesis": {"affected_systems": "The issue affects the Pterodactyl Panel (Panel 1.12.1 and earlier), specifically the Wings server control plane component. Any node that possesses a secret access token stored in the plaintext file /etc/pterodactyl/config.yml can exploit the flaw. The flaw allows a node to fetch details and manipulate servers that belong to other nodes, thereby violating the principle of least privilege for all servers managed by the panel.", "description_and_impact": "The vulnerability in Pterodactyl\u2019s Wings control plane arises from an improperly enforced authorization check on several API endpoints. Any authenticated node, identified only by its secret token, can request information about any server across the entire panel, ignoring the intended node\u2011server relationship. This omission permits attackers to retrieve installation scripts that may contain sensitive values, alter installation and transfer statuses, and delete servers on remote nodes. Because the affected endpoints expose configuration data and control commands, an attacker can leverage the accessible information to move laterally, exfiltrate secrets, and trigger destructive actions such as permanent data loss. The weakness is classified as unauthorized access (CWE\u2011283) and secret information disclosure (CWE\u2011639).", "risk_and_exploitability": "The CVSS score of 9.2 marks this flaw as critical, reflecting the high potential impact on confidentiality, integrity, and availability. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild, yet the absence of this vulnerability from the CISA KEV catalog does not diminish the need for remediation. Attackers must first obtain a valid node secret token, which is the prerequisite for leveraging the vulnerable endpoints. Once in possession of such a token, an adversary can perform remote API calls to read or modify any server configuration, exclude proper authorization checks, and potentially orchestrate large\u2011scale destructive actions across the cluster."}}}}, "created": "2026-02-20T10:06:24.715209+00:00", "updated": "2026-04-17T18:15:26.769112+00:00", "vendors": ["pterodactyl", "pterodactyl$PRODUCT$panel"]}