CVE-2026-86177: subuser escalation to console RCE

CISO Take

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions when creating scheduled tasks, letting a subuser who only holds the narrow schedule.update permission create and immediately trigger a task that runs arbitrary game-server console commands, toggles server power state, or forces backups. This is a classic broken-access-control flaw (CWE-862, CVSS 8.8) rather than an AI/ML-specific weakness — it hits a PHP/Laravel game-server hosting panel, and it landed in this feed only because an automated classifier collided the product name "Pterodactyl Panel" with the unrelated Python "panel" (HoloViz) package tracked as ml_ui; there is no genuine AI/ML architecture at risk here. No EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template exist for this CVE as of publication, so opportunistic mass exploitation is unlikely today, but the low attack complexity and lack of required user interaction make it trivial for any malicious or compromised low-privilege subuser to escalate within a shared/multi-tenant panel. Any organization running self-hosted Pterodactyl for game or application server management should upgrade to 1.14.1 immediately and audit subuser permission grants and scheduled-task logs for unexpected console command entries in the meantime.

Sources: NVD GitHub Advisory vulncheck.com

What is the risk?

CVSS 8.8 (High) reflects full confidentiality/integrity/availability impact with network access, low complexity, and no user interaction — but exploitation requires an authenticated account with at least the schedule.update permission (PR:L), which limits exposure to insiders, compromised low-privilege accounts, or multi-tenant hosting environments rather than unauthenticated internet-wide attackers. No EPSS score, no CISA KEV entry, no public PoC, and no Nuclei template were found, indicating no evidence of active or imminent mass exploitation. The realistic risk profile is elevated for shared game-hosting providers exposing subuser accounts to less-trusted customers or staff, and comparatively low for single-tenant/admin-only deployments.

How does the attack unfold?

Initial Access

Attacker holds or compromises a low-privilege subuser account with only the schedule.update permission.

Exploitation

Subuser creates a scheduled task specifying a privileged action (console command, power control, or backup) that the panel fails to authorize against the subuser's actual permissions.

Trigger

Attacker immediately triggers the newly created task via the API rather than waiting for its cron schedule, bypassing any time-based detection.

Impact

The task executes with elevated effect, running arbitrary console commands, changing server power state, or creating an unauthorized backup.

Initial Access

Attacker holds or compromises a low-privilege subuser account with only the schedule.update permission.

Exploitation

Subuser creates a scheduled task specifying a privileged action (console command, power control, or backup) that the panel fails to authorize against the subuser's actual permissions.

Trigger

Attacker immediately triggers the newly created task via the API rather than waiting for its cron schedule, bypassing any time-based detection.

Impact

The task executes with elevated effect, running arbitrary console commands, changing server power state, or creating an unauthorized backup.

How severe is it?

CVSS 3.1

8.8 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 24% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Trivial

Exploitation Confidence

medium

○ CISA SSVC: Public PoC

○ Public PoC indexed (trickest/cve)

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I High

A High

What should I do?

1 step

Upgrade Pterodactyl Panel to version 1.14.1 or later, which adds the missing action-specific permission checks in StoreTaskRequest and RunTaskJob (see commit 913b354). As an interim workaround, restrict or remove the schedule.update permission from subusers who should not be able to run console commands, control power state, or trigger backups, and review any subusers who currently hold that permission alone. Detection: audit scheduled task creation/trigger logs and server console command history for actions performed by subuser accounts outside their expected role, particularly power-state changes or backup creation immediately following a new schedule's creation.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Code Execution Framework

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-86177?

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions when creating scheduled tasks, letting a subuser who only holds the narrow schedule.update permission create and immediately trigger a task that runs arbitrary game-server console commands, toggles server power state, or forces backups. This is a classic broken-access-control flaw (CWE-862, CVSS 8.8) rather than an AI/ML-specific weakness — it hits a PHP/Laravel game-server hosting panel, and it landed in this feed only because an automated classifier collided the product name "Pterodactyl Panel" with the unrelated Python "panel" (HoloViz) package tracked as ml_ui; there is no genuine AI/ML architecture at risk here. No EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template exist for this CVE as of publication, so opportunistic mass exploitation is unlikely today, but the low attack complexity and lack of required user interaction make it trivial for any malicious or compromised low-privilege subuser to escalate within a shared/multi-tenant panel. Any organization running self-hosted Pterodactyl for game or application server management should upgrade to 1.14.1 immediately and audit subuser permission grants and scheduled-task logs for unexpected console command entries in the meantime.

Is CVE-2026-86177 actively exploited?

Proof-of-concept exploit code is publicly available for CVE-2026-86177, increasing the risk of exploitation.

How to fix CVE-2026-86177?

Upgrade Pterodactyl Panel to version 1.14.1 or later, which adds the missing action-specific permission checks in StoreTaskRequest and RunTaskJob (see commit 913b354). As an interim workaround, restrict or remove the schedule.update permission from subusers who should not be able to run console commands, control power state, or trigger backups, and review any subusers who currently hold that permission alone. Detection: audit scheduled task creation/trigger logs and server console command history for actions performed by subuser accounts outside their expected role, particularly power-state changes or backup creation immediately following a new schedule's creation.

What is the CVSS score for CVE-2026-86177?

CVE-2026-86177 has a CVSS v3.1 base score of 8.8 (HIGH). The EPSS exploitation probability is 0.31%.

What are the technical details?

Original Advisory

Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permission to execute arbitrary console commands. Attackers can create and immediately trigger scheduled tasks that run game-server console commands, control server power state, or create backups without proper authorization checks.

Exploitation Scenario

A shared game-hosting provider grants a customer's staff subuser the schedule.update permission so they can manage their own maintenance windows. That subuser abuses the missing action-specific validation to create a new scheduled task configured to send a console command, then immediately triggers the task via the API instead of waiting for its cron schedule. The panel executes the task without re-checking that the subuser holds permission for the underlying action (console command, power control, or backup), so the attacker gains the ability to run arbitrary commands on the game server console, forcibly restart/stop the server, or exfiltrate data via an unauthorized backup — all without ever holding the higher-privilege permissions those actions normally require.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.