All packages
Pterodactyl vulnerabilities
3 known CVE vulnerabilities in Pterodactyl, translated and rated.
- CVE-2026-61609High
A vulnerability in Pterodactyl causes a global login rate limit affecting all users. The limit is global, not per IP, allowing an attacker to block login for everyone by sending about 10 requests per minute.
- CVE-2026-54593High
A vulnerability in Pterodactyl allows an authenticated subuser to write arbitrary files to the server without the required permissions. A JWT token issued for other operations (e.g., WebSocket) can be reused for file uploads.
- CVE-2026-35202Low
Vulnerability in Pterodactyl prior to version 1.12.3. A logic flaw in the Client API allows users to bypass database allocation limits due to a broken locking mechanism.