What is the CVSS score of CVE-2026-21696?

CVE-2026-21696 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wings are affected by CVE-2026-21696?

Organizations using version 1.7.0 and should be aware of notable risk from CVE-2026-21696, a resource exhaustion vulnerability rated CVSS 6.5. Service availability could be impacted.. A patch is available.

Is there a public PoC exploit available for CVE-2026-21696?

Yes, a public proof-of-concept exploit is available for CVE-2026-21696. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-21696?

Within 30 days: Identify affected systems running version 1.7.0 and and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Wings CVE-2026-21696

MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-01-19 security-advisories@github.com

GHSA-2497-gp99-2m74

SQLi Wings Suse Pterodactyl

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

SUSE

MEDIUM

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

PoC Detected

Feb 02, 2026 - 20:40 vuln.today

Public exploit code

CVE Published

Jan 19, 2026 - 20:15 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records. After Wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the max parameter limit of SQLite, 32766 as of SQLite 3.32.0. If wings attempts to delete more than 32766 entries from the SQLite database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not remove any entries from the database. These entries are then indefinitely re-processed and resent to the panel each time the cron runs. By successfully exploiting this vulnerability, an attacker can trigger a situation where wings will keep uploading the same activity data to the panel repeatedly (growing each time to include new activity) until the panels' database server runs out of disk space. Version 1.12.0 fixes the issue.

AnalysisAI

Wings for Pterodactyl versions 1.7.0 through 1.11.x fail to respect SQLite's maximum parameter limit when deleting activity log entries, allowing authenticated users to trigger a database error that prevents log cleanup and causes indefinite accumulation of records. This denial of service condition degrades panel performance and availability over time. Public exploit code exists for this vulnerability, and no patch is currently available.

Technical ContextAI

Classified as CWE-400 (Uncontrolled Resource Consumption). Affects Wings. Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit when processing activity log entries allowing for low privileged user to trigger a condition that floods the panel with activity records. After Wings sends activity logs to the panel it deletes the processed activity entries from the wings SQLite database. However, it does not consider the ma

RemediationAI

Monitor vendor advisories for a patch. Restrict network access to the affected service where possible.

More in Wings

View all

CVE-2023-32080 HIGH This Week

8.8 May 10

Wings is the server control plane for Pterodactyl Panel. Rated high severity (CVSS 8.8), this vulnerability is remotely

CVE-2023-25152 HIGH This Week

8.8 Feb 08

Wings is Pterodactyl's server control plane. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable,

CVE-2024-27102 HIGH This Week

8.5 Mar 13

Wings is the server control plane for Pterodactyl Panel. Rated high severity (CVSS 8.5), this vulnerability is remotely

CVE-2024-34066 HIGH This Week

8.4 May 03

Pterodactyl wings is the server control plane for Pterodactyl Panel. Rated high severity (CVSS 8.4), this vulnerability

CVE-2023-25168 HIGH This Week

8.2 Feb 09

Wings is Pterodactyl's server control plane. Rated high severity (CVSS 8.2), this vulnerability is remotely exploitable.

CVE-2026-61617 HIGH This Week

7.7 Aug 26

Disk quota enforcement is absent from the SFTP write path in Pterodactyl Wings 1.13.2 and earlier, allowing any tenant w

CVE-2025-69199 MEDIUM This Month

6.5 Jan 19

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.

CVE-2021-32699 MEDIUM This Month

6.5 Jun 22

Wings is the control plane software for the open source Pterodactyl game management system. Rated medium severity (CVSS

CVE-2024-34068 MEDIUM This Month

6.4 May 03

Pterodactyl wings is the server control plane for Pterodactyl Panel. Rated medium severity (CVSS 6.4), this vulnerabilit

CVE-2025-68954 MEDIUM This Month

5.4 Jan 06

Pterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP co

Same weakness CWE-400 – Uncontrolled Resource Consumption

View all

CVE-2023-44487 HIGH POC

7.5

CVE-2026-45498 HIGH POC

7.5

CVE-2016-8610 HIGH

7.5

CVE-2026-28318 HIGH POC

7.5

7.5

7.5

7.5

7.5

Same technique SQLi

View all

CVE-2019-7481 HIGH POC

7.5

CVE-2025-57819 CRITICAL POC

10.0

CVE-2017-8917 CRITICAL POC

9.8

CVE-2024-27956 CRITICAL POC

9.9

CVE-2014-3704 HIGH POC

7.5

CVE-2016-2555 CRITICAL POC

9.8

CVE-2016-8582 CRITICAL POC

9.8

CVE-2013-0333 HIGH POC

7.5

Vendor StatusVendor

SUSE

Severity: Medium

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-21696 vulnerability details – vuln.today

Back

Wings CVE-2026-21696

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Wings

Same weakness CWE-400 – Uncontrolled Resource Consumption

Same technique SQLi

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code