Description
Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| pterodactyl | panel | < 1.14.1 | 1.14.1 |
References
- Patch Commit patch
- Researcher Advisory third-party-advisory exploit
- StoreTaskRequest permission and rules technical-description
- RunTaskJob action dispatch technical-description
- Pterodactyl Panel v1.14.1 Release Notes release-notes
- https://github.com/pterodactyl/panel product
- VulnCheck Advisory: Pterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks third-party-advisory