Detections
Analytics

SCA: security update for github.com/pterodactyl/wings (GHSA-2497-gp99-2m74)

high Tenable Self-Hosted Container Security Plugin ID 436833

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Wings is the server control plane for Pterodactyl, a free, open-source game server management panel.
 Starting in version 1.7.0 and prior to version 1.12.0, Wings does not consider SQLite max parameter limit
 when processing activity log entries allowing for low privileged user to trigger a condition that floods
 the panel with activity records. After Wings sends activity logs to the panel it deletes the processed
 activity entries from the wings SQLite database. However, it does not consider the max parameter limit of
 SQLite, 32766 as of SQLite 3.32.0. If wings attempts to delete more than 32766 entries from the SQLite
 database in one query, it triggers an error (SQL logic error: too many SQL variables (1)) and does not
 remove any entries from the database. These entries are then indefinitely re-processed and resent to the
 panel each time the cron runs. By successfully exploiting this vulnerability, an attacker can trigger a
 situation where wings will keep uploading the same activity data to the panel repeatedly (growing each
 time to include new activity) until the panels' database server runs out of disk space. Version 1.12.0
 fixes the issue. (CVE-2026-21696)

See Also

https://github.com/advisories/GHSA-2497-gp99-2m74

Plugin Details

Severity: High

ID: 436833

Version: Revision 1.6

Type: Local

Family: SCA Checks

Published: 1/21/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.73

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2026-21696

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.9

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.3

Threat Score: 7

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/20/2026

Vulnerability Publication Date: 1/19/2026

Reference Information

CVE: CVE-2026-21696