CVE-2026-21696: 
NixOS vulnerability analysis and mitigation

CVE-2026-21696 is a denial-of-service vulnerability in Pterodactyl Wings, the server control plane for the open-source game server management panel Pterodactyl. The flaw allows a low-privileged user to trigger unbounded accumulation of activity log entries by exceeding SQLite's maximum parameter limit (32,766 as of SQLite 3.32.0), causing Wings to endlessly reprocess and resubmit the same activity data to the panel until the panel's database server runs out of disk space. It affects Wings versions 1.7.0 through 1.11.x and was disclosed on January 19, 2026, with a patch released in version 1.12.0. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 8.3 (High) (Github Advisory, Wings Advisory).

The root cause is uncontrolled resource consumption (CWE-400) and allocation of resources without limits or throttling (CWE-770) in Wings' activity log cron jobs (internal/cron/activity_cron.go line 81 and internal/cron/sftp_cron.go line 86). When Wings processes activity log entries and attempts to delete them from its local SQLite database using a single WHERE id IN ? query, it does not enforce SQLite's hard limit of 32,766 bound parameters per query. If more than 32,766 entries exist, SQLite returns SQL logic error: too many SQL variables (1), the deletion fails silently, and the entries remain in the database to be reprocessed on every subsequent cron cycle — growing exponentially with each run. A PoC exploit using SFTP to rapidly create many small files (generating large numbers of activity entries) is publicly available at https://ptero.co/mococesoca.go (Wings Advisory, activity_cron.go).

Successful exploitation results in a denial-of-service condition affecting the availability of the entire Pterodactyl panel. The attacker causes Wings to repeatedly upload an ever-growing set of duplicate activity records to the panel's database server, which eventually exhausts available disk space and renders the panel unavailable to all users. There is no confidentiality or integrity impact, but the availability impact extends beyond the Wings node itself to the panel's backend database, potentially affecting all hosted game servers managed by the installation (Github Advisory, Wings Advisory).

A public proof-of-concept exploit is available, referenced in the official security advisory, which uses SFTP operations to rapidly generate the required 32,767+ activity entries. The advisory notes the condition can also be triggered by normal, non-malicious use, lowering the practical barrier to exploitation. There is no confirmed evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.04–0.08%, indicating a low but non-negligible probability of exploitation in the near term (Github Advisory, Wings Advisory).

1. Obtain low-privileged access: Acquire a valid Pterodactyl panel account with access to at least one game server and SFTP credentials for that server.
2. Connect via SFTP: Use an SFTP client (e.g., sftp, lftp, or a scripted client) to connect to the Wings SFTP endpoint for the target server.
3. Generate mass activity entries: Rapidly create 32,767 or more small files via SFTP (e.g., using a loop script similar to the published PoC at https://ptero.co/mococesoca.go). Each file creation generates an activity log entry in Wings' local SQLite database.
4. Trigger the SQLite limit: Wait for the Wings activity cron job to run. When it attempts to delete all accumulated entries in a single WHERE id IN ? query exceeding 32,766 parameters, SQLite returns an error and no entries are deleted.
5. Sustain the DoS: On each subsequent cron cycle, Wings re-reads all undeleted entries, sends them again to the panel (growing the dataset), and again fails to delete them. New activity entries are appended each cycle, causing exponential growth in the panel's database until disk space is exhausted and the panel becomes unavailable (Wings Advisory, Github Advisory).

• Database: Rapid, unbounded growth of the Wings SQLite database file (typically located in the Wings data directory); repeated duplicate activity records accumulating in the Pterodactyl panel's database.
• Logs: Wings logs showing repeated SQLite errors such as SQL logic error: too many SQL variables (1) during cron execution; Wings logs showing the same activity batch being sent to the panel on every cron cycle without deletion.
• File System: Unusually large number of small files appearing in a game server's SFTP directory in a short time window, consistent with automated file creation.
• Panel Database: Disk usage on the panel's database server growing continuously without a corresponding increase in legitimate user activity; database tables for activity logs showing duplicate entries with identical timestamps and metadata (Wings Advisory).

Upgrade Pterodactyl Wings to version 1.12.0 or later, which fixes the issue by properly handling SQLite's maximum parameter limit when deleting activity log entries. No configuration-based workaround is available for unpatched versions. As a temporary precaution prior to patching, administrators should monitor disk usage on the panel's database server and consider setting up disk usage alerts. Operators running Wings 1.7.0 through 1.11.x should treat this update as high priority given the ease of exploitation by low-privileged users (Github Advisory, Wings Advisory).

The vulnerability was reported by researcher danny6167 and published by anthonyphysgun via the Pterodactyl GitHub security advisory process on January 19, 2026. The advisory notes that the condition has been triggered by normal, non-malicious use in production environments, suggesting it may have caused unintentional outages before being identified as a security issue. Coverage has appeared on security aggregation sites including Vulners, VulDB, and radar.offseq.com, as well as a dedicated write-up at infinitsec.net (Wings Advisory, Github Advisory).