CVE-2026-86177: Pterodactyl Panel

High severity, CVSS 8.8. EPSS: 0.6% chance of exploitation in the next 30 days.

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.

Affected products

• Pterodactyl Panel: before 1.14.1 (fixed in 1.14.1)

Published 2026-09-05. Last modified 2026-09-24.