CVE-2026-52855 Details
Description
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.
A vulnerability in Pterodactyl Wings versions prior to 1.12.3 allows low-privileged users to access sensitive information from the daemon configuration through egg configuration-file templates. The issue arises because placeholders in these templates can be manipulated to read confidential data such as the node's daemon token, token ID, and Docker registry credentials. This vulnerability could lead to a full compromise of the node, as the exposed token allows unauthorized actions on all servers hosted on that node.
Users are advised to upgrade Pterodactyl Wings to version 1.12.3 or later. After upgrading, it is recommended to rotate the daemon tokens, as previously exfiltrated tokens remain valid until reset. For those unable to upgrade immediately, audit eggs to ensure that no user-editable variables are rendered into configuration files, or mark such variables as non-editable.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 31, 2026CISA-ADP
Assessed Jul 31, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/pterodactyl/wings/commit/eb65e27ae077a63e38518c490768486af1cd86a9 | [email protected] | Source CodeVendor |
| https://github.com/pterodactyl/wings/releases/tag/v1.12.3 | [email protected] | Release NotesVendor |
| https://github.com/pterodactyl/wings/security/advisories/GHSA-pfvc-3p5h-x7h6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-522 | Insufficiently Protected Credentials | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Pterodactyl Wings | < 1.12.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 31, 2026 | CVE Modified | CISA-ADP |
| Jul 31, 2026 | New CVE Received | [email protected] |