CVE-2026-86177: Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Pterodactyl Panelto a version that resolves this vulnerability.Fixed in 1.14.1 - Compensating control
Review and restrict who can create scheduled tasks in the Pterodactyl Panel so only fully authorized users can use the schedule.update permission to create/trigger tasks that run console commands or control power/backup actions.
Event History
Frequently Asked Questions
Which deployments should be prioritized for remediation?
Pterodactyl Panel versions before 1.14.1 should be prioritized where subusers are granted the schedule.update permission. Those users can create and immediately trigger scheduled tasks beyond their intended authorization.
What access does an attacker need to exploit this issue?
An attacker needs authenticated subuser access with only the schedule.update permission. No user interaction is required.