Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-ex7c-s6tk-cub4
Vulnerability ID VCID-ex7c-s6tk-cub4
Aliases CVE-2026-26016
GHSA-g7vw-f8p5-c728
Summary Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization A missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about any server on a Pterodactyl instance, even if that server is associated with a different node. This issue stems from missing logic to verify that the node requesting server data is the same node that the server is associated with. Any authenticated Wings node can retrieve server installation scripts (potentially containing secret values) and manipulate the installation status of servers belonging to other nodes. Wings nodes may also manipulate the transfer status of servers belonging to other nodes. _This vulnerability requires a user to acquire a secret access token for a node. We rated this issue based on potential worst outcome. Unless a user gains access to a Wings secret access token they would not be able to access any of these vulnerable endpoints, as every endpoint requires a valid node access token._
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-283 Unverified Ownership
CWE-639 Authorization Bypass Through User-Controlled Key
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00065 https://api.first.org/data/v1/epss?cve=CVE-2026-26016
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-g7vw-f8p5-c728
cvssv4 9.2 https://github.com/pterodactyl/panel
generic_textual CRITICAL https://github.com/pterodactyl/panel
cvssv4 9.2 https://github.com/pterodactyl/panel/releases/tag/v1.12.1
generic_textual CRITICAL https://github.com/pterodactyl/panel/releases/tag/v1.12.1
ssvc Track https://github.com/pterodactyl/panel/releases/tag/v1.12.1
cvssv3.1_qr CRITICAL https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728
cvssv4 9.2 https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728
generic_textual CRITICAL https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728
ssvc Track https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728
cvssv4 9.2 https://nvd.nist.gov/vuln/detail/CVE-2026-26016
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2026-26016
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-26016
https://github.com/pterodactyl/panel
https://github.com/pterodactyl/panel/releases/tag/v1.12.1
CVE-2026-26016 https://nvd.nist.gov/vuln/detail/CVE-2026-26016
GHSA-g7vw-f8p5-c728 https://github.com/advisories/GHSA-g7vw-f8p5-c728
GHSA-g7vw-f8p5-c728 https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L Found at https://github.com/pterodactyl/panel
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L Found at https://github.com/pterodactyl/panel/releases/tag/v1.12.1
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-20T15:29:43Z/ Found at https://github.com/pterodactyl/panel/releases/tag/v1.12.1
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L Found at https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2026-02-20T15:29:43Z/ Found at https://github.com/pterodactyl/panel/security/advisories/GHSA-g7vw-f8p5-c728
Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-26016
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.20551
EPSS Score 0.00065
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:50:10.608794+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/packagist/pterodactyl/panel/CVE-2026-26016.yml 38.6.0