CVE-2021-41273

Name: CVE-2021-41273
Creator: NVD / NIST
Published: 2021-11-17T20:15:10.4+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 4.3/10EPSS 0.38%

Last modified Jun 17, 2026

CVE-2021-41273 is a medium-severity vulnerability rated 4.3/10 on the CVSS scale. Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment token. EPSS estimates a 0.38% chance of exploitation in the next 30 days.

Description

Pterodactyl is an open-source game server management panel built with PHP 7, React, and Go. Due to improperly configured CSRF protections on two routes, a malicious user could execute a CSRF-based attack against the following endpoints: Sending a test email and Generating a node auto-deployment token. At no point would any data be exposed to the malicious user, this would simply trigger email spam to an administrative user, or generate a single auto-deployment token unexpectedly. This token is not revealed to the malicious user, it is simply created unexpectedly in the system. This has been addressed in release `1.6.6`. Users may optionally manually apply the fixes released in v1.6.6 to patch their own systems.

Metrics

CVSS 3.1

4.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

EPSS Probability

0.38%

29.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Pterodactyl	Panel	< 1.6.6

References

https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5Patch, Third Party Advisory
https://github.com/pterodactyl/panel/security/advisories/GHSA-wwgq-9jhf-qgw6Patch, Third Party Advisory
https://github.com/pterodactyl/panel/commit/bf9cbe2c6d5266c6914223e067c56175de7fc3a5Patch, Third Party Advisory
https://github.com/pterodactyl/panel/security/advisories/GHSA-wwgq-9jhf-qgw6Patch, Third Party Advisory

Timeline

Published: Nov 17, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-41273?

How severe is CVE-2021-41273?

CVE-2021-41273 has a CVSS score of 4.3/10 (MEDIUM severity). The EPSS model estimates a 0.38% probability of exploitation in the next 30 days.

How do I fix CVE-2021-41273?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-41273?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST