CVE-2021-41273 Cross-Site Request Forgery allowing sending of test emails and generation of node auto-deployment keys
Attackers can force administrative users to send test emails or generate unexpected auto-deployment tokens via CSRF in Pterodactyl panel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-41273?
CVE-2021-41273 is a medium-severity vulnerability in pterodactyl panel, published on 17 Nov 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment token. At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system. This has been addressed in release `1.6.6`. Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems.
Weakness: CWE-352
Which versions are affected by CVE-2021-41273?
2 open source packages ship an affected version, including pterodactyl/panel. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
pterodactyl/panel Packagist | All versions | 1.6.6 |
pterodactyl/panel Packagist | All versions | 1.6.6 |
Products include Pterodactyl Panel.
How do I fix CVE-2021-41273?
Upgrade pterodactyl/panel to 1.6.6 or later.
Is CVE-2021-41273 being exploited?
There is no known exploitation of CVE-2021-41273 in the wild and no public exploit code.
Other vulnerabilities in pterodactyl panel
- CVE-2026-26016 Pterodactyl Panel Allows Cross-Node Server Configuration Disclosure via Remote API Missing Authorization
- CVE-2021-41129 Authentication bypass in Pterodactyl
- CVE-2025-68954 Pterodactyl does not revoke SFTP access when server is deleted or permissions reduced
- CVE-2019-1020002 Pterodactyl vulnerable to 2FA Sniffing
- CVE-2025-69197 Pterodactyl TOTPs can be reused during validity window
Sources
Also known as GHSA-wwgq-9jhf-qgw6.