CVE-2026-61617: SFTP quota bypass causes node-wide

CISO Take

Wings, the control plane behind the Pterodactyl game/app-server hosting panel, checks a tenant's disk quota only once — as a stale boolean at file-open time — and never re-validates it as an SFTP upload streams in, so any tenant with SFTP write access to a single hosted server can write an unbounded file and fill the entire host node's disk, knocking every other server on that node offline. There is no CISA KEV listing, no EPSS score, and no public exploit or scanner template for this CVE, but the CVSS 7.7 (AV:N/AC:L/PR:L/S:C/A:H) reflects that exploitation requires only low-privilege authenticated access already granted to any legitimate tenant and no user interaction — this is a trivial, deterministic denial-of-service, not a theoretical one. Genuine AI/ML relevance here is weak: this is infrastructure for hosting arbitrary application/game servers, not an AI framework, model, or inference stack, and it only becomes an AI-security concern insofar as an organization happens to run ML training jobs, model-serving containers, or GPU workloads as tenants on a shared Pterodactyl/Wings node — in that scenario a single malicious or compromised low-privilege tenant can starve disk I/O for co-located inference/training pods. Action: upgrade Wings to 1.13.3 immediately on any node with multi-tenant SFTP write access, and in the interim monitor per-server and node-level disk utilization for uploads that exceed the configured quota without the server being auto-suspended.

Sources:NVDGitHub Advisory

What is the risk?

High confidence, low-complexity DoS: CVSS 3.1 base 7.7 (AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H) — no confidentiality or integrity impact, pure availability. Exploitability is trivial for anyone who already has SFTP write access to even one hosted server (a normal, low-privilege tenant capability), and no public PoC or scanner is needed to reproduce it given the description is explicit and a patch commit is public. No EPSS/KEV data exists yet since this is a fresh disclosure (published 2026-08-26), but the low bar for exploitation (single unbounded upload) means real-world abuse — accidental or malicious — is plausible soon after disclosure. Blast radius is scoped to the shared host node: every server co-located on that node goes down when its disk fills, making this a classic 'noisy neighbor becomes hostile neighbor' multi-tenancy failure. This is NOT an AI/ML-specific vulnerability — Wings/Pterodactyl is a generic game/app server management panel, and its 'ml_ui' categorization here appears to be a classification artifact rather than a genuine AI product match.

How does the attack unfold?

Initial Access

Attacker uses legitimate low-privilege SFTP write credentials already granted for one hosted server on the target Wings node.

Exploitation

Attacker opens an SFTP write handle and streams an unbounded file, exploiting the stale, one-time boolean quota check that is never re-validated mid-transfer.

AML.T0029

Impact

The host node's physical disk fills completely, crashing every server co-located on that node, including any AI/ML workloads sharing the same disk.

Initial Access

Attacker uses legitimate low-privilege SFTP write credentials already granted for one hosted server on the target Wings node.

Exploitation

Attacker opens an SFTP write handle and streams an unbounded file, exploiting the stale, one-time boolean quota check that is never re-validated mid-transfer.

AML.T0029

Impact

The host node's physical disk fills completely, crashing every server co-located on that node, including any AI/ML workloads sharing the same disk.

How severe is it?

CVSS 3.1

7.7 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 38% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○CISA SSVC: Public PoC

○Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SChanged

CNone

INone

AHigh

What should I do?

1 step

1) Upgrade Wings to version 1.13.3 or later, which fixes the fix commit referenced in GHSA-8j54-xcwx-597p. 2) Until patched, treat every SFTP-write-capable tenant as a potential single point of node-wide failure — avoid co-locating any AI/ML or otherwise critical workloads on shared Wings nodes with untrusted tenants. 3) Detection: alert on node-level disk utilization approaching capacity combined with any single server's disk usage exceeding its configured quota without that server being flagged/suspended — this combination is the signature of active exploitation. 4) Post-patch, verify quota enforcement is now re-checked mid-transfer (not just at handle-open) by testing an oversized upload against a quota-limited test server. 5) Review whether suspended-for-quota servers are correctly blocked from further SFTP writes as part of validating the fix.

What does CISA's SSVC say?

DecisionTrack*

Exploitationpoc

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoSInferenceAML.T0029- Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE-4.1-AI system risks and benefits are monitored, and mechanisms for changing system behavior are documented

Frequently Asked Questions

What is CVE-2026-61617?

Wings, the control plane behind the Pterodactyl game/app-server hosting panel, checks a tenant's disk quota only once — as a stale boolean at file-open time — and never re-validates it as an SFTP upload streams in, so any tenant with SFTP write access to a single hosted server can write an unbounded file and fill the entire host node's disk, knocking every other server on that node offline. There is no CISA KEV listing, no EPSS score, and no public exploit or scanner template for this CVE, but the CVSS 7.7 (AV:N/AC:L/PR:L/S:C/A:H) reflects that exploitation requires only low-privilege authenticated access already granted to any legitimate tenant and no user interaction — this is a trivial, deterministic denial-of-service, not a theoretical one. Genuine AI/ML relevance here is weak: this is infrastructure for hosting arbitrary application/game servers, not an AI framework, model, or inference stack, and it only becomes an AI-security concern insofar as an organization happens to run ML training jobs, model-serving containers, or GPU workloads as tenants on a shared Pterodactyl/Wings node — in that scenario a single malicious or compromised low-privilege tenant can starve disk I/O for co-located inference/training pods. Action: upgrade Wings to 1.13.3 immediately on any node with multi-tenant SFTP write access, and in the interim monitor per-server and node-level disk utilization for uploads that exceed the configured quota without the server being auto-suspended.

Is CVE-2026-61617 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-61617, increasing the risk of exploitation.

How to fix CVE-2026-61617?

1) Upgrade Wings to version 1.13.3 or later, which fixes the fix commit referenced in GHSA-8j54-xcwx-597p. 2) Until patched, treat every SFTP-write-capable tenant as a potential single point of node-wide failure — avoid co-locating any AI/ML or otherwise critical workloads on shared Wings nodes with untrusted tenants. 3) Detection: alert on node-level disk utilization approaching capacity combined with any single server's disk usage exceeding its configured quota without that server being flagged/suspended — this combination is the signature of active exploitation. 4) Post-patch, verify quota enforcement is now re-checked mid-transfer (not just at handle-open) by testing an oversized upload against a quota-limited test server. 5) Review whether suspended-for-quota servers are correctly blocked from further SFTP writes as part of validating the fix.

What systems are affected by CVE-2026-61617?

This vulnerability affects the following AI/ML architecture patterns: model serving, shared multi-tenant infrastructure.

What is the CVSS score for CVE-2026-61617?

CVE-2026-61617 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.44%.

What is the AI security impact?

Affected AI Architectures

model servingshared multi-tenant infrastructure

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

Wings is the server control plane for the Pterodactyl game-server management panel. In versions up to and including 1.13.2, the SFTP write path does not enforce a server's disk quota during a transfer, allowing a tenant with SFTP write access to a single server to exhaust the host node's physical disk and take down every server on it. Wings checks available space only once, as a boolean, when the write handle is opened, using a stale cached usage value and without knowing the size of the incoming data, and it then returns a raw, unaccounted file handle that is never re-checked as the transfer proceeds. A single upload can therefore be written without bound, far beyond the configured disk limit, until the node's disk is full, and because a server stopped for exceeding its limit is not treated as suspended, SFTP writes are still accepted even after the quota is already exceeded. This issue is fixed in version 1.13.3.

Exploitation Scenario

A tenant with legitimate SFTP write credentials to a single hosted server (e.g., a game server they rent) opens an SFTP session and begins uploading a single large file — a garbage blob, a zip bomb equivalent, or simply /dev/zero output — far exceeding their allotted disk quota. Because Wings only validated available space as a boolean at the moment the write handle opened, using a stale cached usage figure, it never re-checks as bytes continue to flow, and it never learns the total incoming size upfront. The transfer continues unthrottled until the physical disk on the host node fills completely. Every other tenant's server on that same node — potentially including internal tooling, ML inference containers, or CI/CD workers sharing the node — then fails or crashes due to disk-full errors, and because Wings does not treat an over-quota server as suspended, the attacker's own SFTP session keeps accepting writes even after the quota is already blown, allowing the attack to continue unabated.

Weaknesses (CWE)

CWE-400Uncontrolled Resource ConsumptionPrimary CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-400Uncontrolled Resource Consumption CWE-770Allocation of Resources Without Limits or Throttling

CWE-400 — Uncontrolled Resource Consumption: The product does not properly control the allocation and maintenance of a limited resource.

[Architecture and Design] Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
[Architecture and Design] Mitigation of resource exhaustion attacks requires that the target system either: The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker. recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed.

Source: MITRE CWE corpus.