{"answers":{"affected":"5 open source packages ship an affected version, including github.com/pterodactyl/wings and pterodactyl/panel.","exploited":"There is no known exploitation of GHSA-hr7j-63v7-vj7g in the wild and no public exploit code.","fix":"Upgrade github.com/pterodactyl/wings to 1.12.1 or later.","what":"GHSA-hr7j-63v7-vj7g is a vulnerability in github.com/pterodactyl/wings, published on 17 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-hr7j-63v7-vj7g and fix it if it is affected.\n\nWhat it is: GHSA-hr7j-63v7-vj7g is a vulnerability in github.com/pterodactyl/wings, published on 17 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-hr7j-63v7-vj7g in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/pterodactyl/wings (Go): affected all versions; fixed in 1.12.1\n- github.com/pterodactyl/wings (Go): affected all versions; fixed in 1.12.1\n- github.com/pterodactyl/wings (Go): affected all versions; fixed in 1.12.1\n- pterodactyl/panel (Packagist): affected all versions; fixed in 1.12.1\n- pterodactyl/panel (Packagist): affected all versions; fixed in 1.12.1\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-hr7j-63v7-vj7g/ (Markdown: https://insights.sbomify.com/GHSA-hr7j-63v7-vj7g/index.md)","id":"GHSA-hr7j-63v7-vj7g","markdown":"https://insights.sbomify.com/GHSA-hr7j-63v7-vj7g/index.md","name":"GHSA-hr7j-63v7-vj7g","record":{"aliases":["GO-2026-4497"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Game server panel","requires_auth":"low_privilege","summary":"Attackers with active SFTP sessions retain file access after account deletion or password changes, bypassing credential revocation mechanisms.","user_interaction":"not_required","vuln_class":"security_feature_bypass"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Summary\nDeleting a user account with SFTP access or changing the user's password does not immediately terminate existing SFTP sessions, allowing continued filesystem access after credentials are revoked.\nThis can result in unintended and unauthorized access to server files even after administrators believe access has been fully invalidated.\n\n### Details\nWhen a user with SFTP access is deleted from the Pterodactyl Panel or when the user's password is changed while one or more SFTP connections are active, those existing connections remain fully functional.\n\nNeither account deletion nor password change invalidates the authentication state of already-established SFTP sessions. As a result, the active SFTP connection pool continues to allow read and write operations until the client disconnects or the session times out.\n\nThis behavior occurs even when the password is changed by an administrator through the panel, meaning credential rotation does not revoke active access.\n\nThis suggests that active SFTP sessions are not tracked or forcefully terminated on credential revocation events. This effectively prevents administrators from responding to credential compromise incidents in real time.\n\n### PoC\nScenario 1: Account deletion\n1. Create a user with SFTP access to a server.\n2. Connect to the server via SFTP using any SFTP client (e.g. sftp, FileZilla).\n3. Keep the SFTP session open and active.\n4. Delete the user account from the Pterodactyl Panel.\n5. Continue performing file operations through the already-established SFTP connection.\n\nResult:\nThe SFTP session remains active and usable despite the user account being deleted.\n\nScenario 2: Password change\n1. Create a user with SFTP access to a server.\n2. Establish an active SFTP connection.\n3. Change the user's password (including via administrator panel).\n4. Continue performing file operations using the existing SFTP connection.\n\nResult:\nThe SFTP session remains active and usable even after the password has been changed.\n\n### Impact\nThis issue prevents immediate revocation of compromised credentials. Vulnerability type: Access control / session invalidation issue\n\nImpacted parties:\n\n1. Server administrators\n2. Hosting providers using Pterodactyl Panel\n\nSecurity impact:\n\nDeleted users may retain filesystem access longer than intended, which can lead to:\n\n1. Unauthorized data access\n2. Data modification or deletion\n3. Compliance and security policy violations","ecosystems":["Go","Packagist"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Pterodactyl Panel's SFTP sessions remain active after user account deletion or password change","id":"GHSA-hr7j-63v7-vj7g","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"Go","product":null,"products":[],"type":"security_feature_bypass","year":"2026"},"n_packages":5,"n_references":null,"packages":[{"ecosystem":"Go","fixed":["1.12.1"],"introduced":["0"],"last_affected":[],"package":"github.com/pterodactyl/wings","purl":null,"source":"GHSA-hr7j-63v7-vj7g"},{"ecosystem":"Go","fixed":["1.12.1"],"introduced":["0"],"last_affected":[],"package":"github.com/pterodactyl/wings","purl":"pkg:golang/github.com/pterodactyl/wings","source":"GHSA-hr7j-63v7-vj7g"},{"ecosystem":"Go","fixed":["1.12.1"],"introduced":["0"],"last_affected":[],"package":"github.com/pterodactyl/wings","purl":"pkg:golang/github.com/pterodactyl/wings","source":"GO-2026-4497"},{"ecosystem":"Packagist","fixed":["1.12.1"],"introduced":["0"],"last_affected":[],"package":"pterodactyl/panel","purl":null,"source":"GHSA-hr7j-63v7-vj7g"},{"ecosystem":"Packagist","fixed":["1.12.1"],"introduced":["0"],"last_affected":[],"package":"pterodactyl/panel","purl":"pkg:composer/pterodactyl/panel","source":"GHSA-hr7j-63v7-vj7g"}],"products":null,"published":"2026-02-17","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers with active SFTP sessions retain file access after account deletion or password changes, bypassing credential revocation mechanisms.","url":"https://insights.sbomify.com/GHSA-hr7j-63v7-vj7g/"}