← Vulnerability feed

Vulnerability record · CVE-2021-41273 · published 17 November 2021

CVE-2021-41273: Pterodactyl panel cross-site request forgery vulnerability

Pterodactyl · Panel

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment token. At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system. This has been addressed in release `1.6.6`. Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems.

4.3 CVSS 3.1 Medium EPSS 0.39% · top 69.4% CWE-352 · Cross-site request forgery
4.3CVSS 3.1 base score, v2 4.3
0.39%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment token. At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system. This has been addressed in release `1.6.6`. Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5 PatchThird Party Advisory
https://github.com/pterodactyl/panel/security/advisories/GHSA-wwgq-9jhf-qgw6 PatchThird Party Advisory
https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5 PatchThird Party Advisory
https://github.com/pterodactyl/panel/security/advisories/GHSA-wwgq-9jhf-qgw6 PatchThird Party Advisory

Track CVE-2021-41273 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.2CVE-2026-26016Pterodactyl panel insecure direct object reference vulnerabilityWings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to version 1.12.1, a missing authorization…EPSS 0.46%8.1CVE-2021-41129Pterodactyl panel deserialization of untrusted data vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. A malicious user can modify the contents of a `confirmati…EPSS 1.8%7.5CVE-2025-68954Pterodactyl panel insufficient session expiration vulnerabilityPterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below do not revoke active SFTP connections when a user is remo…EPSS 0.25%7.5CVE-2019-1020002Pterodactyl panel observable discrepancy vulnerabilityPterodactyl before 0.7.14 with 2FA allows credential sniffing.EPSS 1.5%6.5CVE-2025-69197Pterodactyl panel improper authentication vulnerabilityPterodactyl is a free, open-source game server management panel. Versions 1.11.11 and below allow TOTP to be used multiple times during its validity …EPSS 0.36%6.1CVE-2024-34067Pterodactyl panel cross-site scripting vulnerabilityPterodactyl is a free, open-source game server management panel built with PHP, React, and Go. Importing a malicious egg or gaining access to wings i…EPSS 0.46%6.0CVE-2025-69198Pterodactyl panel uncontrolled resource consumption vulnerabilityPterodactyl is a free, open-source game server management panel. Pterodactyl implements rate limits that are applied to the total number of resources…EPSS 0.24%4.3CVE-2021-41176Pterodactyl panel cross-site request forgery vulnerabilityPterodactyl is an open-source game server management panel built with PHP 7, React, and Go. In affected versions of Pterodactyl a malicious user can …EPSS 0.52%

Source: NIST National Vulnerability Database (record CVE-2021-41273), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.