Secuno
ENNL
Book demo

CVE-2026-54593

Pterodactyl vulnerability

8.1 HIGHEPSS 0.68%
  1. Published28 Jul 2026

Description

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredLow
User interactionNone
ScopeUnchanged
ConfidentialityNone
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-764138.2
A vulnerability in Cisco Adaptive Security Device Manager (ASDM) single sign-on (SSO)…
CVE-2026-494998.8
Dell PowerProtect Data Manager, versions prior to 20.2.0.0, contain(s) a Generation of…
CVE-2024-365339.8
Insecure permissions in volcano v1.8.2 allows attackers to access sensitive data and…
CVE-2023-28829.8
Generation of Incorrect Security Tokens vulnerability in CBOT Chatbot allows Token…

Frequently asked

Is CVE-2026-54593 being actively exploited?

CVE-2026-54593 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.68%.

How severe is CVE-2026-54593?

CVE-2026-54593 has a CVSS 3.1 base score of 8.1, rated high. EPSS estimates a 0.68% probability of exploitation.

How do I fix CVE-2026-54593?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-54593 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Get Patch this first every Monday

Five vulnerabilities that matter this week, ranked on real exploitation. Plain language, one email, no spam.

You can unsubscribe with one click from every issue. We handle your details as described in our privacy policy.

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.