CVE-2026-54593: Panel JWT reuse enables file upload

CISO Take

A privilege escalation flaw in Pterodactyl Wings (the daemon that manages hosted server containers) lets any authenticated subuser reuse a JWT issued for one purpose — such as WebSocket console access or a backup download link — to upload arbitrary files via the /upload/file endpoint, even without the file.create permission. This matters for any organization self-hosting AI workloads (model inference containers, agent execution sandboxes, or fine-tuning jobs) behind a Pterodactyl-managed panel, since an arbitrary file write on a container running such workloads can be leveraged to plant a web shell, overwrite startup scripts, or tamper with model artifacts. There is no evidence of active exploitation (not in CISA KEV, no EPSS score, no public exploit or Nuclei template published), but the PoC requires only a handful of lines of Python and no attacker skill beyond having any subuser-level account on a server — that trivial bar for exploitation is the real driver of urgency here, not observed in-the-wild activity. CISOs should confirm which self-hosted infrastructure runs Wings/Panel and upgrade to Wings 1.12.2+ and Panel 1.12.3+ immediately; in the interim, review subuser permission grants and audit `/upload/file` request logs for tokens issued to non-upload endpoints. Treat this as an infrastructure hardening item rather than an AI-specific vulnerability class — the risk stems from token-scope validation, not from any AI/ML component itself.

Sources: NVD GitHub Advisory OpenSSF CISA KEV

What is the risk?

CVSS 8.1 (High) reflects a low bar to exploit (PR:L, no user interaction) combined with high integrity and availability impact, but zero confidentiality impact. Exploitation requires the attacker to already hold a valid, even minimally-privileged, subuser account on the target server — this is not an unauthenticated, internet-wide attack surface, which caps the realistic blast radius to insider threats, compromised low-privilege accounts, or multi-tenant hosting scenarios where subusers are semi-trusted. No KEV listing, no EPSS data, no public exploit code, and no Nuclei template exist, so there is currently no evidence of mass scanning or active exploitation. However, the attack itself is trivial once the precondition (any subuser access) is met — it's a simple token-reuse trick with a working PoC in the advisory, so time-to-exploit for a motivated insider or lateral-movement attacker is minimal. Package risk score (26/100) and OpenSSF Scorecard (6.9/10) suggest reasonable overall project hygiene despite 50 historical CVEs in the codebase, indicating an actively maintained but frequently-patched project.

How does the attack unfold?

Legitimate low-privilege access

Attacker holds or compromises a subuser account on a Pterodactyl-managed server with minimal permissions such as console/websocket access only.

Purpose-scoped token acquisition

Subuser requests a Panel-issued JWT for a legitimate lower-privilege action, e.g. the WebSocket console endpoint or a backup/file download link.

Token replay against Wings upload endpoint

Attacker resubmits the captured JWT directly to the Wings /upload/file endpoint, which accepts it because it only checks server_uuid/user_uuid/unique_id claims, not intended scope.

Arbitrary file write impact

Attacker writes arbitrary files (e.g., a web shell or tampered inference/agent startup script) to the server despite lacking file.create permission, enabling further code execution or integrity compromise.

Legitimate low-privilege access

Attacker holds or compromises a subuser account on a Pterodactyl-managed server with minimal permissions such as console/websocket access only.

Purpose-scoped token acquisition

Subuser requests a Panel-issued JWT for a legitimate lower-privilege action, e.g. the WebSocket console endpoint or a backup/file download link.

Token replay against Wings upload endpoint

Attacker resubmits the captured JWT directly to the Wings /upload/file endpoint, which accepts it because it only checks server_uuid/user_uuid/unique_id claims, not intended scope.

Arbitrary file write impact

Attacker writes arbitrary files (e.g., a web shell or tampered inference/agent startup script) to the server despite lacking file.create permission, enabling further code execution or integrity compromise.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Panel	go	< 1.12.2	`1.12.2`
5.7K OpenSSF 6.9 491 dependents Pushed 4d ago 62% patched ~17d to patch Full package profile →
Panel	composer	< 1.12.3	`1.12.3`
5.7K OpenSSF 6.9 491 dependents Pushed 4d ago 62% patched ~17d to patch Full package profile →

How severe is it?

CVSS 3.1

8.1 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C None

I High

A High

What should I do?

1 step

Patch immediately: upgrade Wings to >= 1.12.2 and Panel to >= 1.12.3, which scope JWTs to their intended purpose so a WebSocket or download token can no longer be replayed against /upload/file. Until patched, review and minimize subuser permission grants — remove console/download/backup access for subusers who don't need it, since those permissions are the entry point for token replay. Audit Wings access logs for POST requests to /upload/file using tokens whose claims don't match an upload-intent context, and monitor for unexpected file writes on hosted containers, especially in servers running AI model-serving or agent-execution workloads. Rotate any long-lived subuser sessions after patching to invalidate tokens that may have already been minted under the vulnerable logic.

How is it classified?

Auth Bypass Code Execution Inference

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluated and documented

Frequently Asked Questions

What is CVE-2026-54593?

A privilege escalation flaw in Pterodactyl Wings (the daemon that manages hosted server containers) lets any authenticated subuser reuse a JWT issued for one purpose — such as WebSocket console access or a backup download link — to upload arbitrary files via the /upload/file endpoint, even without the file.create permission. This matters for any organization self-hosting AI workloads (model inference containers, agent execution sandboxes, or fine-tuning jobs) behind a Pterodactyl-managed panel, since an arbitrary file write on a container running such workloads can be leveraged to plant a web shell, overwrite startup scripts, or tamper with model artifacts. There is no evidence of active exploitation (not in CISA KEV, no EPSS score, no public exploit or Nuclei template published), but the PoC requires only a handful of lines of Python and no attacker skill beyond having any subuser-level account on a server — that trivial bar for exploitation is the real driver of urgency here, not observed in-the-wild activity. CISOs should confirm which self-hosted infrastructure runs Wings/Panel and upgrade to Wings 1.12.2+ and Panel 1.12.3+ immediately; in the interim, review subuser permission grants and audit `/upload/file` request logs for tokens issued to non-upload endpoints. Treat this as an infrastructure hardening item rather than an AI-specific vulnerability class — the risk stems from token-scope validation, not from any AI/ML component itself.

Is CVE-2026-54593 actively exploited?

No confirmed active exploitation of CVE-2026-54593 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-54593?

Patch immediately: upgrade Wings to >= 1.12.2 and Panel to >= 1.12.3, which scope JWTs to their intended purpose so a WebSocket or download token can no longer be replayed against /upload/file. Until patched, review and minimize subuser permission grants — remove console/download/backup access for subusers who don't need it, since those permissions are the entry point for token replay. Audit Wings access logs for POST requests to /upload/file using tokens whose claims don't match an upload-intent context, and monitor for unexpected file writes on hosted containers, especially in servers running AI model-serving or agent-execution workloads. Rotate any long-lived subuser sessions after patching to invalidate tokens that may have already been minted under the vulnerable logic.

What systems are affected by CVE-2026-54593?

This vulnerability affects the following AI/ML architecture patterns: model serving, agent frameworks.

What is the CVSS score for CVE-2026-54593?

CVE-2026-54593 has a CVSS v3.1 base score of 8.1 (HIGH).

What is the AI security impact?

Affected AI Architectures

model servingagent frameworks

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: MEASURE 2.7

What are the technical details?

Original Advisory

Pterodactyl is a free, open-source game server management panel. Prior to Panel version 1.12.3 and Wings version 1.12.2, the Wings /upload/file endpoint accepted any valid panel-signed JWT that contained server_uuid, user_uuid, and unique_id claims without checking the token's intended purpose; because the Panel issues JWTs carrying those same claims for lower-privilege operations such as WebSocket authentication and file-download links, an authenticated subuser could reuse one of those tokens (for example a WebSocket token obtained with only the websocket.connect permission) by replaying it against /upload/file to write arbitrary files to the same server, despite never being granted the file.create permission. This issue is fixed in Panel version 1.12.3 and Wings version 1.12.2.

Exploitation Scenario

A malicious or compromised low-privilege team member is added as a subuser to a Pterodactyl-managed server hosting an LLM inference container, with permissions limited to console viewing only (websocket.connect). They open the server console in the browser, capture the WebSocket authentication JWT issued by the Panel for that session, and replay it directly against the Wings node's /upload/file endpoint instead of using it for its intended WebSocket handshake. Because Wings validates only that the JWT contains a valid server_uuid/user_uuid/unique_id signed by the Panel — not the token's intended scope — the upload succeeds despite the subuser lacking file.create permission. The attacker uploads a malicious script or web shell into the container's filesystem, using it to tamper with the inference server's startup behavior, exfiltrate the served model, or pivot further into the hosting environment.

Weaknesses (CWE)

CWE-1259 Improper Restriction of Security Token Assignment Primary CWE-1270 Generation of Incorrect Security Tokens Primary CWE-1259 Improper Restriction of Security Token Assignment CWE-1259 Improper Restriction of Security Token Assignment CWE-1270 Generation of Incorrect Security Tokens CWE-1270 Generation of Incorrect Security Tokens

CWE-1259 — Improper Restriction of Security Token Assignment: The System-On-A-Chip (SoC) implements a Security Token mechanism to differentiate what actions are allowed or disallowed when a transaction originates from an entity. However, the Security Tokens are improperly protected.

[Architecture and Design, Implementation] Security Token assignment review checks for design inconsistency and common weaknesses. Security-Token definition and programming flow is tested in both pre-silicon and post-silicon testing.

Source: MITRE CWE corpus.