Executive brief
Pelican Panel is a game server management tool that allows administrators to configure and control containerized game servers. The vulnerability allows authenticated users with limited startup read permissions to bypass authorization controls and modify server configurations, including startup commands and Docker images, leading to arbitrary command execution inside containers. This could compromise game server availability and allow attackers to execute malicious code with container-level privileges.
Technical details
Pelican Panel enforces startup write permissions exclusively through disabled HTML form controls on the client side rather than implementing server-side authorization checks. An attacker with startup.read permission can bypass this client-side restriction by crafting malicious Livewire state updates to invoke afterStateUpdated callbacks, enabling modification of startup commands, Docker images, and environment variables. The vulnerability requires the attacker to already have authenticated access with startup.read permission and can result in arbitrary command execution within the container. The fix is available in version 1.0.0-beta35 and later.
Affected products
- Pelican Panel before 1.0.0-beta35
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Fix available in version 1.0.0-beta35 and later