CVE-2026-35202 LOW

CVE-2026-35202: Pterodactyl has a database resource limit bypass via race condition in Client API

Vendor Pterodactyl
Product panel
Weakness CWE-367
Published June 2, 2026
Last update June 3, 2026
View on NVD All CVEs

CVSS base score

2.3/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.

Key dates

02Disclosure timeline

June 2, 2026 CVE published
June 3, 2026 Record updated