Pterodactyl Panel Command Execution via Scheduled Tasks

Executive Summary

CVE-2026-86177 is a privilege escalation flaw in Pterodactyl Panel versions before 1.14.1. It allows subusers with only schedule.update permission to create and execute arbitrary console commands via scheduled tasks without proper authorization checks. Attackers can trigger tasks immediately to control server power states, run game-server commands, or create backups, bypassing intended access restrictions.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Pterodactyl Panel versions before 1.14.1. Verify if subusers with schedule.update permission can create and execute arbitrary console commands. Inspect scheduled tasks for unexpected commands, power actions, or backups. Review logs for unauthorized task executions.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with limited permissions to execute unauthorized actions like running arbitrary commands, controlling server power, or creating backups. This could lead to data breaches, unauthorized access to sensitive files, or disruption of game servers. The impact includes privilege escalation and potential compromise of server integrity.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Pterodactyl Panel to version 1.14.1 or later. Review subuser permissions to ensure they only have necessary access. Remove schedule.update permission from users who do not require it. Monitor scheduled tasks for suspicious activity.

Useful 0 Not Useful 0