CVE-2026-35202
Low
Description
Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.
SeverityLow
CVSS2.3
Exploit probability—
ProductPterodactyl/panel
PublishedJun 2, 2026
First seenJun 2, 2026
How to fix
Update
- pterodactyl/panel1.12.3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| pterodactyl/panelPackagist | v < 1.12.3 | 1.12.3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.