High severity8.8NVD Advisory· Published Sep 5, 2026
CVE-2026-86177
CVE-2026-86177
Description
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
Affected products
1- Range: <1.14.1
Patches
Vulnerability mechanics
References
6- github.com/geo-chen/oss/blob/main/panel.mdnvd
- github.com/pterodactyl/panel/blob/v1.14.0/app/Http/Requests/Api/Client/Servers/Schedules/StoreTaskRequest.phpnvd
- github.com/pterodactyl/panel/blob/v1.14.0/app/Jobs/Schedule/RunTaskJob.phpnvd
- github.com/pterodactyl/panel/commit/913b354aff43ff04fce95357ed68a675a1dd0fa6nvd
- github.com/pterodactyl/panel/releases/tag/v1.14.1nvd
- www.vulncheck.com/advisories/pterodactyl-panel-before-1.14.1-privilege-escalation-via-schedule-tasksnvd
News mentions
0No linked articles in our index yet.