CVE-2026-35202CWE-367CWE-770

Pterodactyl has a database resource limit bypass via race condition in Client API

Low · published June 2, 2026

CVSS v4.0
2.3
EPSS
0%
Percentile
27.1
In the wild
Unconfirmed
What it is

Pterodactyl is a free, open-source game server management panel. Prior to version 1.12.3, the Pterodactyl Client API has a logic flaw that lets users bypass their assigned limits for database allocations. This happens because the database locking mechanism used in the controllers is totally broken and doesn't actually lock anything. Version 1.12.3 patches the issue.

The record
Technical detail
CVSS v4.0
2.3 · LOW
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
EPSS
0.00348 · 27.1th percentile
Weaknesses
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition; CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-06-02T19:03Z
EPSS history
Timeline
  • 02 JUN 19:03Z
    Pterodactyl has a database resource limit bypass via race condition in Client API
    cvelistv5