Executive brief
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change
Affected products
- Go github.com/pterodactyl/wings
- Packagist pterodactyl/panel
Junglewise Threat Intelligence
Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change
Severity: medium · CVSS 4 · Published 2026-02-17
Technologies: github.com/pterodactyl/wings (Go), pterodactyl/panel (Packagist). Vendors: Go, Packagist.
Related threats
- Pterodactyl Wings denial of service in SFTP handshake
- Pterodactyl Wings sensitive information disclosure in egg templates
- Pterodactyl Wings memory exhaustion in configuration file parsers
- Pterodactyl Panel authentication denial of service in login rate limiter
- Pterodactyl Panel and Wings privilege escalation via JWT scope reuse