CVE-2025-69198, CVE-2025-69199, and CVE-2026-21696 in Pterodactyl
If you run Pterodactyl in production, CVE-2025-69198, CVE-2025-69199, and CVE-2026-21696 are the kind of issues that don’t always look scary in a headline—but can absolutely ruin your day in ops.
These three vulnerabilities hit the two places that matter most: Panel behavior under heavy request pressure and Wings behavior under WebSocket + logging edge-cases. Translation: resource exhaustion, noisy incidents, and “why is my disk melting?” tickets.
Official advisory links:
CVE-2025-69198: https://github.com/pterodactyl/panel/security/advisories/GHSA-jw2v-cq5x-q68g
CVE-2025-69199: https://github.com/pterodactyl/panel/security/advisories/GHSA-8w7m-w749-rx98
CVE-2026-21696: https://github.com/pterodactyl/wings/security/advisories/GHSA-2497-gp99-2m74
What these CVEs mean in real life
All three can end in some flavor of denial of service or resource starvation:
Filling storage faster than your limits should allow
Burning CPU/RAM/network due to unthrottled or repeated workloads
Spamming Panel with activity data until the database runs out of disk
If you sell game hosting, this isn’t theoretical—this is literally how you get weekend incident calls and angry clients.
CVE-2025-69198 — Resource limit bypass via request bursts (Panel)
What it is: Pterodactyl enforces per-server limits for resources like databases, allocations, and backups, but in versions prior to 1.12.0, those checks can be bypassed by sending a large number of requests at the same time. The core problem is that validation happens early and doesn’t lock the target resource while processing, so concurrent requests can all pass validation and then all create resources.
Why it matters: A malicious user can:
Create more databases/allocations/backups than allowed
Consume limited node allocations
Fill backup storage faster than your policy intends
Starve resources that other users on the system need
Who’s affected: Panel versions < 1.12.0 (patched in 1.12.0).
What to do: Upgrade Panel to 1.12.0 as the real fix. In the meantime (or additionally), putting sane rate limiting/WAF rules in front of your Panel endpoints is a practical safety net—but it’s not a substitute for patching.
