CVE-2026-86177 — Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbit…
Published: 2026-09-05 · CVSS: 8.7 · CVSS 4.0
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7