Quick answers
- Is CVE-2026-35202 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-35202 being exploited in the wild.
- How severe is CVE-2026-35202?
- Medium severity, with a CVSS score of 4, published 2 June 2026.
- Which products and versions are affected?
- pterodactyl/panel (Packagist) < 1.12.3, ECOSYSTEM:introduced=0,fixed=1.12.3; Pterodactyl Panel < 1.12.3.
- Is there a fix for CVE-2026-35202?
- Yes. pterodactyl/panel (Packagist): upgrade to 1.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-35202 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-35202?
- Check whether you run pterodactyl/panel (Packagist) or Pterodactyl Panel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- pterodactyl/panel (Packagist): upgrade to 1.12.3 or later
composer require pterodactyl/panel:^1.12.3
Technical details
A race condition (TOCTOU) exists in DatabaseController.php because of an improperly implemented Laravel database lock. The code calls lockForUpdate() on a query builder but fails to execute a terminal method (such as get() or count()), resulting in a no-op that does not actually engage a pessimistic lock. An attacker with low privileges can send multiple concurrent requests to the database creation endpoint; since no lock is held, each request may pass the limit check simultaneously. This allows the creation of resources on the physical host exceeding the configured server limits. The issue is resolved in version 1.12.3.
Affected products
- Pterodactyl Panel < 1.12.3
Identifiers
- CVE-2026-35202
- GHSA-fgmm-w5cx-vrfw
Timeline
- 2026-05-23: advisory: GitHub security advisory published
- 2026-06-02: disclosed: NVD publication date