CVE-2026-52855
published 2026-07-31CVE-2026-52855: Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg…
PriorityP263critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
0.29%
21.0th percentile
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| github.com | pterodactyl_wings | >= 0 < 1.12.3 | 1.12.3 |
| pterodactyl | wings | < 1.12.3 | 1.12.3 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Pterodactyl Wings up to 1.12.2 Egg Configuration Template Processor information disclosure
vuldb·2026-07-31·CVSS 9.9
CVE-2026-52855 [CRITICAL] Pterodactyl Wings up to 1.12.2 Egg Configuration Template Processor information disclosure
A vulnerability was found in Pterodactyl Wings up to 1.12.2 and classified as problematic. This vulnerability affects unknown code of the component Egg Configuration Template Processor. Executing a manipulation can lead to information disclosure.
This vulnerability is tracked as CVE-2026-52855. The attack can be launched remotely. No exploit exists.
It is suggested to upgrade the affected component.
GHSA
Wings exposes node configuration secrets through egg configuration-file templating
ghsa·2026-07-31
CVE-2026-52855 [CRITICAL] CWE-200 Wings exposes node configuration secrets through egg configuration-file templating
Wings exposes node configuration secrets through egg configuration-file templating
### Impact
**Type:** Exposure of sensitive information / insufficiently protected credentials
leading to privilege escalation and full node compromise.
Wings exposes its **entire** daemon configuration to the egg configuration-file
templating engine. When Wings renders a server's configuration files, any
`{{config.}}` placeholder in a replacement value is resolved against the
full marshalled daemon configuration, with no restriction on which paths may be
read.
Because the Panel substitutes **user-controlled** egg variable values into these
replacements before sending them to Wings, a low-privileged user can smuggle a
`{{config.*}}` placeholder through a variable value. The placeholder is then
resolved by
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-31
Published