CVE-2026-26016

CVE-2026-26016 is a high-severity authorization bypass vulnerability in Pterodactyl Wings, affecting versions prior to 1.12.1. It allows an attacker with a compromised node secret token to access sensitive information, manipulate server states, and potentially cause data loss for any server on the Pterodactyl instance, regardless of its associated node. The attack requires a valid node access token, but once obtained, it grants extensive control and data exfiltration capabilities, including server installation scripts with secret values and the ability to trigger false server transfers leading to data destruction. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.