CVE-2026-54593: Pterodactyl Auth Bypass Vulnerability

CVE-2026-54593 Overview

CVE-2026-54593 affects Pterodactyl, a free and open-source game server management panel. The vulnerability exists in the Wings daemon's /upload/file endpoint, which accepts any panel-signed JSON Web Token (JWT) containing server_uuid, user_uuid, and unique_id claims without validating the token's intended purpose. An authenticated subuser can replay a lower-privilege token such as a WebSocket connection token against the upload endpoint. This allows writing arbitrary files to the target server despite lacking the file.create permission [CWE-1259]. The issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.

Critical Impact
An authenticated subuser with only websocket.connect permission can escalate privileges to write arbitrary files on any server they can access, bypassing the Pterodactyl permission model.

Affected Products

Pterodactyl Panel prior to version 1.12.3
Pterodactyl Wings prior to version 1.12.2
Deployments where subusers hold any panel-issued JWT (WebSocket, file download, backup download)

Discovery Timeline

2026-07-28 - CVE-2026-54593 published to the National Vulnerability Database
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-54593

Vulnerability Analysis

The vulnerability is a token-scope confusion flaw classified as [CWE-1259] (Improper Restriction of Security Token Assignment). Pterodactyl's Panel issues JWTs for multiple purposes, including WebSocket authentication, file download links, backup downloads, and file uploads. Each token carries server_uuid, user_uuid, and unique_id claims that identify the resource and requester.

Before the patch, the Wings daemon's /upload/file endpoint validated only the panel's signature and the presence of these claims. It did not verify what operation the token was minted for. An attacker with any valid panel-signed JWT for the target server could replay that token against the upload endpoint.

Root Cause

The Panel and Wings components lacked a scope claim on issued JWTs. Because tokens issued for websocket.connect and other low-privilege operations were structurally indistinguishable from upload tokens, Wings had no way to enforce which endpoints a given token could reach. The fix introduces a JwtScope enum on the Panel side and scope verification on the Wings side.

Attack Vector

An authenticated subuser with the websocket.connect permission requests a WebSocket token from the Panel through the normal client workflow. The attacker extracts the JWT and issues a POST request to the Wings /upload/file endpoint using that token as the credential. Wings validates the signature and claims, and accepts the upload, writing attacker-controlled content to the server filesystem without the file.create permission.

php

// Panel patch: introduce JWT scope enum
// Source: https://github.com/pterodactyl/panel/commit/7ffcd636310bb72b54bac3280d2a15e727feded7
<?php

namespace Pterodactyl\Enum;

enum JwtScope: string
{
    case Websocket = 'websocket';
    case FileUpload = 'file-upload';
    case FileDownload = 'file-download';
    case BackupDownload = 'backup-download';
    case ServerTransfer = 'transfer';
}

// Wings patch: verify scope on incoming panel-signed tokens
// Source: https://github.com/pterodactyl/wings/commit/d0ddc80844479302abdaf9654de3bacd511c0f5c
// Get the server using the UUID from the token.
if _, ok := manager.Get(token.ServerUuid); !ok || !token.IsUniqueRequest() || !token.HasScope(tokens.BackupDownload) {
    c.AbortWithStatusJSON(http.StatusNotFound, gin.H{
        "error": "The requested resource was not found on this server.",
    })
}

Detection Methods for CVE-2026-54593

Indicators of Compromise

Unexpected files appearing in server directories that do not match legitimate deployment or player activity
Wings access logs showing /upload/file requests from subusers who lack the file.create permission
The same unique_id claim value observed across multiple Wings endpoints in a short timeframe, indicating token replay
Uploaded files with executable extensions or scripts placed in game server startup paths

Detection Strategies

Correlate Panel-issued token requests with Wings endpoint activity to identify tokens used against endpoints beyond their originally requested purpose
Baseline expected upload activity per subuser role and alert on uploads from users without the file.create permission grant
Inspect Wings HTTP access logs for POST /upload/file requests and cross-reference the requesting user's Panel permissions
Monitor for newly created files in server working directories, particularly configuration and startup files

Monitoring Recommendations

Forward Panel and Wings logs to a centralized log store with retention sufficient for post-incident investigation
Track the running versions of Panel and Wings across all nodes to identify unpatched instances
Alert on file writes to sensitive paths such as server startup scripts, plugin directories, and configuration files
Review subuser permission grants and flag accounts that hold websocket.connect on servers containing sensitive data

How to Mitigate CVE-2026-54593

Immediate Actions Required

Upgrade Pterodactyl Panel to version 1.12.3 or later immediately
Upgrade Pterodactyl Wings to version 1.12.2 or later on every node
Rotate the Panel JWT signing key after patching to invalidate any tokens issued before the fix
Audit recent uploads on all managed game servers for unauthorized files

Patch Information

The official fixes are documented in GitHub Security Advisory GHSA-8r6w-3qq5-4p4r. The Panel patch is available in commit 7ffcd63 and the corresponding Wings patch in commit d0ddc80. Additional context is available in the pull request discussion.

Workarounds

If immediate patching is not possible, revoke the websocket.connect permission from all subusers to limit token issuance
Restrict network access to the Wings daemon so only the Panel host can reach /upload/file
Review all subuser accounts and remove any that are unnecessary until nodes can be updated
Monitor Wings logs continuously for anomalous upload requests until the patch is applied

bash

# Verify installed versions after upgrade
cd /var/www/pterodactyl && php artisan --version
wings --version

# Expected minimums:
# Panel: 1.12.3
# Wings: 1.12.2