Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.7

Pterodactyl Panel lets subusers run unauthorized commands

CVE-2026-86177 · published 1 month ago
Summary

The Pterodactyl Panel (versions before 1.14.1) does not correctly check permissions when a subuser creates a scheduled task. This lets a subuser who can only edit schedules run any console command, change server power state, or start backups without proper approval. Update the Panel to version 1.14.1 or later, or restrict subuser permissions until the fix is applied.

What to do
  • Update pterodactyl panel to version 1.14.1 or later.
Affected software
VendorProductAffected versions
pterodactyl panel < 1.14.1
Original advisory text
Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.7 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published5 Sep 2026
Updated9 Oct 2026
First seen5 Sep 2026
Sources
CVE-2026-86177 · NVD
CVE-2026-86177 · MITRE
CVE-2026-86177 · OSV
Track software like this
Free during beta