Raw vector
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-26016 is a critical-severity Unverified Ownership (CWE-283) vulnerability in Pterodactyl Panel. Its CVSS base score is 9.2 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-25 (Reference Monitor) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-26016 is a missing authorization vulnerability affecting Wings, the server control plane component of Pterodactyl, a free open-source game server management panel. Prior to version 1.12.1, multiple controllers in Wings lack logic to verify that a requesting node matches the server it is querying, allowing unauthorized access to server data across nodes.
An attacker who obtains a Wings node secret token—typically stored in plaintext at /etc/pterodactyl/config.yml—can exploit this remotely over the network. With a valid token, they gain network-level access to endpoints that expose sensitive information for any server on the Pterodactyl instance, regardless of node association. This enables retrieval of server installation scripts containing secrets, manipulation of installation and transfer statuses, lateral movement through the system, excessive notifications, data exfiltration, and permanent data loss by triggering false transfer successes that cause the panel to delete server data from source nodes.
The Pterodactyl security advisory (GHSA-g7vw-f8p5-c728) and release notes for version 1.12.1 recommend upgrading Wings to 1.12.1, which adds the necessary node verification logic to restrict access to associated servers only. The vulnerability carries a CVSS v3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWEs 283 (Unverified Ownership) and 639 (Authorization Bypass Through User-Controlled Key).
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-8438
Vulnerability Data
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about…
more
any server on a Pterodactyl instance, even if that server is associated with a different node. This issue stems from missing logic to verify that the node requesting server data is the same node that the server is associated with. Any authenticated Wings node can retrieve server installation scripts (potentially containing secret values) and manipulate the installation status of servers belonging to other nodes. Wings nodes may also manipulate the transfer status of servers belonging to other nodes. This vulnerability requires a user to acquire a secret access token for a node. Unless a user gains access to a Wings secret access token they would not be able to access any of these vulnerable endpoints, as every endpoint requires a valid node access token. A single compromised Wings node daemon token (stored in plaintext at `/etc/pterodactyl/config.yml`) grants access to sensitive configuration data of every server on the panel, rather than only to servers that the node has access to. An attacker can use this information to move laterally through the system, send excessive notifications, destroy server data on other nodes, and otherwise exfiltrate secrets that they should not have access to with only a node token. Additionally, triggering a false transfer success causes the panel to delete the server from the source node, resulting in permanent data loss. Users should upgrade to version 1.12.1 to receive a fix.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Access enforcement directly requires verifying ownership before granting access to resources.
Requiring access decisions to consider all relevant attributes includes ownership verification.
A reference monitor provides the tamperproof mechanism that can enforce ownership checks.
Associating ownership as a security attribute enables subsequent verification of resource ownership.
Least-privilege restrictions limit the scope of data reachable even if a key check is bypassed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.
Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing authorization checks but does not prevent the weakness in production.
Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.
Access control policies can require ownership verification before granting access to critical resources.
Identity management processes can include verification of resource ownership during provisioning and access decisions.
Access rights reviews can enforce checks that only legitimate owners retain privileges over critical assets.
Privileged access rights assignment should verify ownership to prevent unauthorized elevation on critical resources.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Windows Server 2016 (1 rule)
- V-224831 Local volumes must use a format that supports NTFS attributes. prevents CWE-283
Windows Server 2019 (1 rule)
- V-205663 Windows Server 2019 local volumes must use a format that supports NTFS attributes. prevents CWE-283