CVE-2026-26016: Pterodactyl Wings Auth Bypass Vulnerability

CVE-2026-26016 Overview

CVE-2026-26016 is a critical authorization bypass vulnerability in Wings, the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization check in multiple controllers allows any user with access to a node secret token to fetch information about any server on a Pterodactyl instance, even if that server is associated with a different node. This vulnerability enables cross-node data exfiltration, lateral movement, and potential permanent data loss.

Critical Impact

A single compromised Wings node daemon token grants access to sensitive configuration data of every server on the panel, enabling lateral movement, data destruction, and secret exfiltration across all nodes.

Affected Products

• Pterodactyl Wings prior to version 1.12.1
• Pterodactyl Panel installations using vulnerable Wings versions
• Any Pterodactyl deployment with multiple nodes sharing the same panel

Discovery Timeline

• 2026-02-19 - CVE-2026-26016 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-26016

Vulnerability Analysis

This vulnerability stems from CWE-283: Unverified Ownership, where the Wings control plane fails to verify that the node requesting server data is the same node that the server is associated with. The missing authorization logic in multiple controllers creates a significant security gap that allows any authenticated Wings node to access and manipulate data belonging to servers on other nodes.

The vulnerability is particularly severe because Wings node secret tokens are stored in plaintext at /etc/pterodactyl/config.yml. If an attacker compromises a single node and obtains this token, they gain unauthorized access to sensitive configuration data of every server across the entire Pterodactyl panel installation, rather than being restricted to only the servers that particular node should have access to.

Root Cause

The root cause is missing authorization logic to verify node-to-server ownership associations. When a node makes requests to retrieve server installation scripts, manipulate installation status, or manage transfer states, the application fails to validate that the requesting node actually owns or is associated with the target server. This missing verification check allows any valid node token to access resources belonging to any server in the system.

Attack Vector

The attack requires network access and a valid Wings node secret token. An attacker who has compromised a Wings node or obtained its authentication token from the plaintext configuration file can exploit this vulnerability through the following attack scenarios:

Server Installation Script Retrieval: Any authenticated Wings node can retrieve server installation scripts from other nodes, potentially containing secret values such as database credentials, API keys, or other sensitive configuration data.

Installation Status Manipulation: An attacker can manipulate the installation status of servers belonging to other nodes, potentially disrupting service or causing configuration inconsistencies.

Transfer Status Manipulation: Perhaps most critically, triggering a false transfer success causes the panel to delete the server from the source node, resulting in permanent data loss. This attack vector allows for deliberate destruction of server data across the entire panel infrastructure.

Lateral Movement: With access to sensitive configuration data from all servers, an attacker can move laterally through the system, compromising additional services and exfiltrating secrets that should be isolated to specific nodes.

Detection Methods for CVE-2026-26016

Indicators of Compromise

• Unusual API requests from Wings nodes attempting to access servers not assigned to that node
• Unexpected server installation script retrievals across node boundaries
• Anomalous transfer status changes for servers that were not undergoing legitimate migrations
• Access patterns showing a single node token querying information for servers across multiple nodes
• Unexpected server deletions or data loss following false transfer completion signals

Detection Strategies

• Monitor Wings API access logs for cross-node server information requests
• Implement alerting for server transfer status changes that don't correlate with administrative actions
• Track and correlate node token usage patterns to identify unauthorized cross-node access attempts
• Review audit logs for installation script retrieval events targeting servers on different nodes

Monitoring Recommendations

• Enable verbose logging on Wings daemon to capture all API interactions
• Implement network segmentation monitoring between Wings nodes and the panel
• Set up alerts for any access to /etc/pterodactyl/config.yml on Wings nodes
• Monitor for bulk server information queries that may indicate reconnaissance activity
• Establish baseline node-to-server relationships and alert on deviations

How to Mitigate CVE-2026-26016

Immediate Actions Required

• Upgrade Wings to version 1.12.1 or later immediately
• Rotate all Wings node secret tokens after upgrading to invalidate any potentially compromised credentials
• Audit Wings nodes for signs of compromise, particularly checking for unauthorized access to /etc/pterodactyl/config.yml
• Review server transfer and installation logs for suspicious activity
• Consider restricting network access between Wings nodes until the patch is applied

Patch Information

The vulnerability has been addressed in Wings version 1.12.1. Users should upgrade to this version or later to receive the fix. The patch adds proper authorization checks to verify that the requesting node is associated with the target server before allowing access to server data or permitting status manipulations.

For more information, see the GitHub Security Advisory GHSA-g7vw-f8p5-c728 and the GitHub Release v1.12.1.

Workarounds

• Restrict network access to Wings API endpoints using firewall rules to limit node-to-panel communication
• Implement additional authentication layers or VPN requirements for inter-node communication
• Apply stricter file permissions on /etc/pterodactyl/config.yml to limit exposure of node tokens
• Consider temporarily disabling server transfer functionality until the patch can be applied
• Monitor and log all cross-node API requests as a compensating control

# Restrict access to Wings configuration file
chmod 600 /etc/pterodactyl/config.yml
chown root:root /etc/pterodactyl/config.yml

# Example firewall rule to restrict Wings API access (adjust ports and IPs as needed)
iptables -A INPUT -p tcp --dport 8080 -s <panel_ip_address> -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP