CVE-2026-86177— Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
Quick assessment
Affected
pterodactyl panel
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Pterodactyl Panel 在 1.14.1 版本之前，在创建计划任务时未对特定操作进行权限校验，导致仅拥有 权限的子用户可以执行任意控制台命令。攻击者可以创建并立即触发计划任务，从而运行游戏服务器控制台命令、控制服务器的电源状态，或创建备份，而系统未进行适当的授权检查。
Possible ATT&CK Techniques 3 AI
T1059.001 · PowerShell T1082 · System Information Discovery T1090 · ProxyAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| pterodactyl | panel | < 1.14.1 |
affected |
1.14.1 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-86177
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
Source: CVE Program / CVE List V5
Vulnerability Description
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| pterodactyl | panel | 0 ~ 1.14.1 | - |
|
II. Public POCs for CVE-2026-86177
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-86177
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-86177 (2)
Vendor Advisories for CVE-2026-86177 (1)
Vendor Pages for CVE-2026-86177 (3)
-
-
-
🔗 Release v1.14.1 · pterodactyl/panel · GitHub release-notes
IV. Related Vulnerabilities
Same product: panel
-
CVE-2026-61609
Pterodactyl's shared global rate-limit key on login and 2FA -
CVE-2026-54593
Pterodactyl's improper JWT scoping allows subuser to upload -
CVE-2026-35202
Pterodactyl has a database resource limit bypass via race co -
CVE-2026-34358
CtrlPanel: Missing Authorization on Admin Write Endpoints Al -
CVE-2026-34246
CtrlPanel: Stored XSS in Admin Role Management via Unescaped
Same vendor: pterodactyl
-
CVE-2026-61617
Pterodactyl Wings SFTP write path does not enforce disk quot -
CVE-2026-52856
Wings: Maliciously crafted packet during SFTP connection han -
CVE-2026-52855
Wings exposes node configuration secrets through egg configu -
CVE-2026-52857
Wings: Maliciously or erroneously created parsed config file -
CVE-2026-61609
Pterodactyl's shared global rate-limit key on login and 2FA
Same weakness: CWE-862
-
CVE-2026-86194
Grav Form Plugin before 9.1.22 Cross-Page Form Execution -
CVE-2026-15550
Ninja Forms - Save Progress <= 3.0.30 - Missing Authorizatio -
CVE-2025-9049
Nokri – Job Board WordPress Theme <= 1.6.4 - Missing Authori -
CVE-2026-12843
LearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Cou -
CVE-2026-86178
Pixelfed through 0.12.9 Unauthorized Story Access via API
V. Comments for CVE-2026-86177
No comments yet