CVE-2026-26016: 
PHP vulnerability analysis and mitigation

CVE-2026-26016 is a missing authorization vulnerability in Pterodactyl Wings (the server control plane for the Pterodactyl game server management panel) that allows any authenticated Wings node to access configuration data and manipulate servers belonging to other nodes. Reported by researcher duddnr0615k and published on February 14, 2026, it affects all versions of pterodactyl/panel prior to 1.12.1. The vulnerability carries a CVSS v4 base score of 9.2 (Critical) and a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Pterodactyl Advisory).

The root cause is a missing ownership verification check in multiple API controllers, classified as CWE-283 (Unverified Ownership) and CWE-639 (Authorization Bypass Through User-Controlled Key). Specifically, the Remote API endpoint GET /api/remote/servers/{uuid} returns a server's complete configuration without verifying that the requesting node is the node associated with that server. Similarly, ServerTransferController (both failure() and success() methods) and ServerInstallController fetch servers by UUID without any node ownership check, allowing any authenticated Wings node token to be used to query or manipulate any server on the entire panel instance (GitHub Advisory, Pterodactyl Advisory). Exploitation requires the attacker to first obtain a valid Wings node secret access token, which is stored in plaintext at /etc/pterodactyl/config.yml.

A single compromised Wings node daemon token grants an attacker access to sensitive configuration data — including egg installation scripts that may contain deployment secrets — for every server on the Pterodactyl instance, not just those assigned to the compromised node. Attackers can leverage this for lateral movement across nodes, credential exfiltration, manipulation of installation and transfer statuses of servers on other nodes, and triggering excessive notifications. Most critically, sending a false transfer success signal causes the panel to permanently delete the server from the source node, resulting in irreversible data loss (GitHub Advisory, Pterodactyl Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.041% (roughly the 20th percentile), indicating a currently low probability of exploitation in the next 30 days. Exploitation requires an attacker to first obtain a valid Wings node secret token, which raises the practical attack complexity despite the network-accessible nature of the vulnerable endpoints.

1. Obtain a Wings node token: Gain access to a Wings node daemon's secret access token, stored in plaintext at /etc/pterodactyl/config.yml on any Wings node host (e.g., via server compromise, insider access, or credential theft).
2. Enumerate server UUIDs: Use the compromised node token to authenticate to the Pterodactyl panel's Remote API. Query GET /api/remote/servers/{uuid} with arbitrary or enumerated server UUIDs to retrieve full server configurations — including those belonging to nodes other than the one whose token was stolen.
3. Extract sensitive data: Parse the returned server configuration for secrets embedded in egg installation scripts, environment variables, or deployment credentials that would normally be inaccessible to the compromised node.
4. Manipulate installation status: Send authenticated requests to ServerInstallController endpoints to alter the installation status of servers on other nodes, potentially disrupting service or triggering unintended behaviors.
5. Trigger destructive transfer: Call the success() method of ServerTransferController for a server on another node, causing the panel to treat the transfer as complete and permanently delete the server from its source node, resulting in data loss (GitHub Advisory, Pterodactyl Advisory).

• Network: Unexpected API requests to GET /api/remote/servers/{uuid} originating from a Wings node IP for server UUIDs not associated with that node; API calls to ServerTransferController or ServerInstallController endpoints from nodes that do not own the referenced servers.
• Logs: Panel application logs showing cross-node server configuration lookups (node X requesting data for servers assigned to node Y); repeated or bulk UUID enumeration requests in the Remote API access logs.
• File System: Unauthorized access or modification of /etc/pterodactyl/config.yml on Wings nodes, which contains the plaintext node secret token.
• Application Behavior: Unexpected server deletion events on source nodes following spurious transfer success signals; unexpected changes to server installation status on nodes that did not initiate an installation.

Pterodactyl has released version 1.12.1 of the panel, which scopes remote node access tokens to only allow access to servers belonging to the same node, directly addressing the missing authorization checks (Pterodactyl Release). All users should upgrade to pterodactyl/panel v1.12.1 or later immediately. After patching, administrators should rotate all existing Wings node tokens, audit /etc/pterodactyl/config.yml permissions on all nodes to restrict read access, and implement network segmentation to limit inter-node API communication. Monitoring for anomalous cross-node API access patterns is also recommended as a compensating control.

The vulnerability received coverage from security news outlets including SecurityOnline.info, which highlighted the CVSS 9.2 score and the risk of entire server network exposure (SecurityOnline). Social media activity was noted on Bluesky and Mastodon/infosec.exchange, with the infosec community flagging the severity of the cross-node data exposure. Red Hat also tracked the advisory (Red Hat CVE). The Pterodactyl maintainer DaneEveritt consolidated multiple related security reports (GHSA-7qf5-c6pw-2vcg, GHSA-5733-cwg2-qm64) into this single advisory, indicating the issue was independently discovered by multiple researchers (Pterodactyl Advisory).