CVE-2026-35202

Pterodactyl has a database resource limit bypass via race condition in Client API

State: Published
Severity: 2.3 Low
Published: Jun 2, 2026
Updated: Jun 3, 2026
Reserved: Apr 1, 2026

Description

Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N	GitHub_M

Weaknesses

CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
panelpterodactyl	< 1.12.3Affected

References

https://github.com/pterodactyl/panel/security/advisories/GHSA-fgmm-w5cx-vrfw

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.