What is the CVSS score of CVE-2026-26016?

CVE-2026-26016 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2026-26016?

Within 24 hours: Inventory all Pterodactyl Wings instances and assess exposure scope; isolate affected systems from production networks if possible. Within 7 days: Implement network segmentation to restrict Wings access to authorized administrators only; enable enhanced monitoring and logging on Wings instances. Within 30 days: Establish contingency plans for Wings replacement or migration; monitor vendor advisories for patch release and establish expedited patching procedures.

Panel CVE-2026-26016

HIGH

Unverified Ownership (CWE-283)

2026-02-19 security-advisories@github.com

GHSA-g7vw-f8p5-c728

Information Disclosure Panel Pterodactyl

8.1

CVSS 3.1 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Obtain node secret token
Exploit

Authenticate to Wings API
Execution

Request server data from different node
Impact

Retrieve installation scripts with secrets

Vulnerability Assessment

Weakness	CWE CWE-283 OWASP Top 10:2025 A01:2025 - Broken Access Control ASVS 5.0 V8 - Authorization Ownership verification
Exploitation Conditions	Valid Wings node secret token required. Victim Pterodactyl instance must have multiple nodes configured. Attacker must be able to make authenticated API requests to Wings control plane endpoint.
Impact	CVSS 8.1 (HIGH). Attack vector: Network. Complexity: High. Privileges required: None. User interaction: None. Exploitation requires authentication.
Exploit ScenarioDerived	An attacker (requires authentication) could exploit this flaw, permanent data loss.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.1% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Mar 12, 2026

Missing authorization validation in Pterodactyl Wings prior to version 1.12.1 allows authenticated nodes to access and manipulate servers across different nodes without proper ownership verification. An attacker with a valid node secret token can retrieve sensitive installation scripts, alter server installation states, and modify transfer statuses for servers they should not have access to. The vulnerability requires network access and valid node credentials but carries high impact due to potential exposure of secrets and cross-node server manipulation.

Earlier versions of this analysis (1)

v1 Mar 12, 2026 - 22:03 CVSS 8.1

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. [CVSS 8.1 HIGH]

RemediationAI

Update to version 1.12.1 or later. Restrict network access to the affected service where possible.

Affected Packages

composer pterodactyl/panel fix: 1.12.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in composer

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

Affects Panel. Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about any server on a Pterodactyl instance, even if that server is associated with a different node. This issue stems from missing logic to verify that the node requesting server data is the same node that the server is associated with. Any authent

Know when Panel gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

CVE Published

Feb 19, 2026 - 17:24 nvd

HIGH 8.1

DescriptionGitHub Advisory

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about any server on a Pterodactyl instance, even if that server is associated with a different node. This issue stems from missing logic to verify that the node requesting server data is the same node that the server is associated with. Any authenticated Wings node can retrieve server installation scripts (potentially containing secret values) and manipulate the installation status of servers belonging to other nodes. Wings nodes may also manipulate the transfer status of servers belonging to other nodes. This vulnerability requires a user to acquire a secret access token for a node. Unless a user gains access to a Wings secret access token they would not be able to access any of these vulnerable endpoints, as every endpoint requires a valid node access token. A single compromised Wings node daemon token (stored in plaintext at /etc/pterodactyl/config.yml) grants access to sensitive configuration data of every server on the panel, rather than only to servers that the node has access to. An attacker can use this information to move laterally through the system, send excessive notifications, destroy server data on other nodes, and otherwise exfiltrate secrets that they should not have access to with only a node token. Additionally, triggering a false transfer success causes the panel to delete the server from the source node, resulting in permanent data loss. Users should upgrade to version 1.12.1 to receive a fix.

Executive ViewAI

Why It Matters

A critical vulnerability (CVSS 8.1) exists in Pterodactyl Wings, affecting organizations using this game server management platform. Without an available patch, this poses immediate risk to server infrastructure integrity and data security for any entity relying on this control plane.

Business Impact: High

Compensating Controls

Network segmentation restricting Wings access to administrative networks only; implement WAF rules to monitor and restrict suspicious API calls to Wings endpoints; disable remote Wings management features not essential to operations; enforce multi-factor authentication for all Wings administrative access; deploy intrusion detection signatures for CVE-2026-26016 exploitation attempts; increase logging and alerting on Wings authentication and API activities; consider temporary migration of non-critical game servers pending patch availability.

Threat Intelligence Overview

EPSS Score

0.1%

Top 82% exploitable

Data Quality

4 sources

Confidence: Medium

NVD

CVE.org

EPSS

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.1%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation· derived

None

System Exposure· derived

Open

Automatable· derived

Human Impact

High

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +40

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.