Vulnerability Description
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/geo-chen/oss/blob/main/panel.md
- https://github.com/pterodactyl/panel
- https://github.com/pterodactyl/panel/blob/v1.14.0/app/Http/Requests/Api/Client/S
- https://github.com/pterodactyl/panel/blob/v1.14.0/app/Jobs/Schedule/RunTaskJob.p
- https://github.com/pterodactyl/panel/commit/913b354aff43ff04fce95357ed68a675a1dd
- https://github.com/pterodactyl/panel/releases/tag/v1.14.1
- https://www.vulncheck.com/advisories/pterodactyl-panel-before-1.14.1-privilege-e
FAQ
What is CVE-2026-86177?
CVE-2026-86177 is a vulnerability with a CVSS score of 8.8 (HIGH). Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. ...
How severe is CVE-2026-86177?
CVE-2026-86177 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-86177?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.