CVE-2026-61617: Pterodactyl Wings SFTP DOS Vulnerability

CVE-2026-61617 Overview

CVE-2026-61617 is a resource exhaustion vulnerability [CWE-400] in Pterodactyl Wings, the server control plane for the Pterodactyl game-server management panel. Versions up to and including 1.13.2 fail to enforce per-server disk quotas during Secure File Transfer Protocol (SFTP) uploads. A tenant with SFTP write access to a single server can exhaust the host node's physical disk and take down every server running on that node. The issue is fixed in version 1.13.3.

Critical Impact
An authenticated low-privilege tenant can fill the underlying host disk through a single SFTP upload, causing denial of service for every co-tenant server on the same node.

Affected Products

Pterodactyl Wings versions <= 1.13.2
Fixed in Pterodactyl Wings 1.13.3

Discovery Timeline

2026-08-26 - CVE-2026-61617 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-61617

Vulnerability Analysis

Wings mediates file operations between the Pterodactyl panel and containerized game servers. The SFTP subsystem exposes a write path that should enforce each server's configured disk quota. In vulnerable releases, the enforcement is a one-time boolean check performed when the write handle is opened. That check consults a stale cached disk-usage value and has no knowledge of the incoming file size.

After the initial check succeeds, Wings returns a raw file handle that is never re-evaluated against the quota during the transfer. Uploads therefore proceed without accounting, and a single write can extend far beyond the configured limit until the host disk fills. The impact is cross-tenant: exhausting the node's physical storage impacts every server sharing that disk.

A compounding logic flaw makes the vulnerability easier to reach. When a server is stopped for exceeding its quota, Wings does not treat it as suspended, so SFTP writes continue to be accepted even after the quota has already been surpassed.

Root Cause

The root cause is missing continuous quota accounting in the SFTP write handler. Quota checks rely on a cached usage snapshot and a boolean gate at file-open time, rather than byte-level enforcement during the transfer. This is a classic uncontrolled resource consumption pattern [CWE-400].

Attack Vector

Exploitation requires SFTP write access to any server on a target node. The attacker connects over SFTP and initiates an upload that exceeds the server's configured disk limit. Because Wings does not measure the transfer against the quota as bytes are written, the write continues until the underlying filesystem is full, degrading or halting every server on the node.

// Patch excerpt from sftp/handler.go
// Source: https://github.com/pterodactyl/wings/commit/da1a216cfff5867fa66be32cb1edb93e37fd71ff
	PermissionFileCreate      = "file.create"
	PermissionFileUpdate      = "file.update"
	PermissionFileDelete      = "file.delete"
+	sftpAttributeExtended     = 1 << 31
 )

type Handler struct {

The upstream commit rewrites request handling in the SFTP handler and introduces extended attribute tracking so writes are bounded and accounted for during the transfer. See the GitHub Security Advisory GHSA-8j54-xcwx-597p for the full advisory.

Detection Methods for CVE-2026-61617

Indicators of Compromise

Host filesystem usage approaching 100% on a Wings node while individual server directories exceed their configured disk_limit values.
SFTP upload sessions in Wings logs that continue writing after a server has been stopped for quota violations.
Multiple co-tenant servers on the same node transitioning to a stopped or errored state simultaneously due to ENOSPC errors.

Detection Strategies

Compare per-server directory sizes against the configured Pterodactyl panel quotas and alert on any server whose on-disk footprint exceeds its limit.
Correlate SFTP session activity in Wings logs with sudden disk-usage spikes on the host, focusing on single-session writes larger than the target server's quota.
Monitor container runtime and kernel logs for ENOSPC write failures across multiple game-server containers within a short window.

Monitoring Recommendations

Instrument disk-usage telemetry per Wings node and alert when free space drops below an operational threshold.
Enable and retain SFTP audit logging in Wings, including transferred byte counts per session, and forward to a centralized log platform for retrospective analysis.
Track the state transitions of servers stopped for exceeding quota and alert when SFTP writes continue against those servers.

How to Mitigate CVE-2026-61617

Immediate Actions Required

Upgrade all Wings nodes to version 1.13.3 or later, which enforces quota accounting during SFTP transfers.
Audit current per-server disk usage on every node and identify any servers already exceeding their configured limits.
Restrict or temporarily disable SFTP write access for untrusted tenants until nodes are patched.

Patch Information

The fix is available in Pterodactyl Wings 1.13.3. The corrective changes are in the SFTP handler and are visible in the upstream GitHub Commit da1a216. Full advisory details are published in the GitHub Security Advisory GHSA-8j54-xcwx-597p.

Workarounds

Provision Wings server data directories on a dedicated filesystem or LVM volume sized so that a single tenant cannot impact the host operating system.
Apply filesystem-level quotas (for example, XFS project quotas or ext4 quotas) on each server directory as an out-of-band enforcement layer.
Suspend SFTP access for servers that have already exceeded their configured disk limits until they are brought back into compliance.

bash

# Example: enforce XFS project quotas per Pterodactyl server directory
# Replace <server-uuid> and <limit> with your values
xfs_quota -x -c 'project -s -p /var/lib/pterodactyl/volumes/<server-uuid> 1001' /var/lib/pterodactyl
xfs_quota -x -c 'limit -p bhard=<limit>g 1001' /var/lib/pterodactyl