CVE-2026-92762 Overview
CVE-2026-92762 is a missing authorization vulnerability [CWE-862] in Pelican Panel versions before 1.0.0-beta35. The application enforces startup write permissions only through disabled form controls in the user interface, rather than through server-side authorization checks. Attackers holding the startup.read permission can craft Livewire state updates to invoke afterStateUpdated callbacks and modify startup commands, docker images, and environment variables. This modification path allows execution of arbitrary commands inside the target container, breaking the intended read-only boundary for lower-privileged users.
Critical Impact
Authenticated users with read-only startup access can bypass client-side controls to execute arbitrary commands inside Pelican Panel game server containers.
Affected Products
- Pelican Panel versions prior to 1.0.0-beta35
- Pelican Panel Filament Server Startup page component (app/Filament/Server/Pages/Startup.php)
- Deployments exposing the panel to users granted startup.read permission
Discovery Timeline
- 2026-09-16 - CVE-2026-92762 published to the National Vulnerability Database
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-92762
Vulnerability Analysis
Pelican Panel is a PHP-based game server management panel built on the Filament and Livewire frameworks. The Server Startup page allows privileged users to change the startup command, container image, and environment variables used to launch game server containers. The panel presents these fields as disabled inputs to users who only hold the startup.read permission, while retaining the ability to view current values.
The security boundary breaks because the server does not re-check the caller's write permission when Livewire processes state updates. Livewire components synchronize client-side state to the server through signed but user-controllable payloads. When a property value changes, the framework invokes matching afterStateUpdated callbacks that persist changes to the underlying server model. The impact extends beyond configuration tampering: modified startup commands and docker images execute when the container starts, enabling arbitrary command execution inside the runtime environment.
Root Cause
The root cause is reliance on UI-level controls for authorization. The Startup.php page marks fields as disabled() for users without write privileges but never validates the acting user's permissions inside the afterStateUpdated handlers or the underlying save routine. Disabled form controls are a presentation-layer concern and can be trivially bypassed by clients that speak the Livewire protocol directly. See the GitHub Code Reference in Startup.php for the affected code region.
Attack Vector
An attacker authenticated with startup.read on a target server crafts a Livewire update request targeting the Startup page component. The request sets new values for the startup command, docker image, or environment variables and triggers the corresponding afterStateUpdated callback. The server persists the changes without re-authorization. On the next container start or restart, the injected command runs inside the container context. Details are documented in the GitHub Security Advisory GHSA-4x28-f89q-2276 and the VulnCheck Advisory on Pelican Panel.
No verified proof-of-concept code is available. Refer to the linked advisories for exploitation specifics.
Stop Remote Code Execution Before It Runs
Singularity™ Endpoint detects and blocks exploit attempts at machine speed, including zero-days and novel attack techniques.
Stop Exploit AttemptsDetection Methods for CVE-2026-92762
Indicators of Compromise
- Unexpected modifications to server startup commands, docker image references, or environment variables recorded in Pelican Panel audit logs.
- Container restarts followed by outbound network activity to attacker-controlled infrastructure or unusual process trees inside game server containers.
- Livewire POST requests to Startup page endpoints originating from accounts that hold only startup.read.
Detection Strategies
- Review Pelican Panel activity logs for startup model changes attributed to users whose role grants read-only access.
- Inspect web server access logs for POST requests to Livewire message endpoints referencing the Startup component from lower-privileged sessions.
- Compare current server startup configurations against a known-good baseline and flag drift that was not authorized through a change record.
Monitoring Recommendations
- Forward Pelican Panel application logs and container runtime events to a centralized log platform for correlation and retention.
- Alert on container image changes and startup command edits, especially outside expected maintenance windows.
- Monitor egress from game server containers for connections to command-and-control style destinations following configuration changes.
How to Mitigate CVE-2026-92762
Immediate Actions Required
- Upgrade Pelican Panel to version 1.0.0-beta35 or later on all instances.
- Audit user permission assignments and revoke startup.read from accounts that do not require it.
- Review recent startup command, docker image, and variable changes for unauthorized modifications and revert any suspicious entries.
Patch Information
The fix is available in Pelican Panel 1.0.0-beta35. The maintainers enforce server-side authorization inside the Startup page state handlers so that write operations are rejected for users lacking the write permission. Refer to the GitHub Security Advisory GHSA-4x28-f89q-2276 and the Pelican Panel repository for release notes and commit details.
Workarounds
- Restrict panel access to trusted administrators until the upgrade is applied, using network-level controls or authentication gating.
- Temporarily remove the startup.read permission from non-administrative roles to prevent the Livewire callback from being reachable.
- Rebuild affected containers from trusted images after remediation to remove any persistence introduced through modified startup commands.
# Verify installed Pelican Panel version and upgrade
php artisan --version
cd /var/www/pelican
git fetch --tags
git checkout v1.0.0-beta35
composer install --no-dev --optimize-autoloader
php artisan migrate --force
php artisan queue:restart
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
