Executive brief
Pterodactyl is an open-source management platform used to run and control game servers. A logic flaw in the software allows users to bypass their assigned resource limits and create more databases than they are permitted to have. This could lead to excessive resource consumption on the hosting hardware and potentially cause the management interface to become unstable or stop working.
Technical details
A race condition (TOCTOU) exists in DatabaseController.php because of an improperly implemented Laravel database lock. The code calls lockForUpdate() on a query builder but fails to execute a terminal method (such as get() or count()), resulting in a no-op that does not actually engage a pessimistic lock. An attacker with low privileges can send multiple concurrent requests to the database creation endpoint; since no lock is held, each request may pass the limit check simultaneously. This allows the creation of resources on the physical host exceeding the configured server limits. The issue is resolved in version 1.12.3.
Affected products
- Pterodactyl Panel < 1.12.3
Timeline
- 2026-05-23: advisory: GitHub security advisory published
- 2026-06-02: disclosed: NVD publication date