CVE-2026-52855: Wings Information Disclosure Vulnerability

CVE-2026-52855 Overview

CVE-2026-52855 affects Pterodactyl Wings, the server control plane for the Pterodactyl open-source game server management panel. The vulnerability allows a low-privileged user to read sensitive daemon configuration values through {{config.}} placeholders in egg configuration-file templates. An attacker can extract {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. The issue is fixed in version 1.12.3 and is classified as an information exposure weakness [CWE-200].

Critical Impact
Low-privileged users can exfiltrate daemon authentication tokens and Docker registry credentials, enabling full compromise of the Wings daemon and connected infrastructure.

Affected Products

Pterodactyl Wings versions prior to 1.12.3
Pterodactyl game server management panel deployments using vulnerable Wings daemons
Multi-tenant hosting environments running Pterodactyl with untrusted users

Discovery Timeline

2026-07-31 - CVE-2026-52855 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-52855

Vulnerability Analysis

Pterodactyl Wings uses egg configuration-file templates to configure game servers. These templates support {{config.*}} placeholders that are resolved against the Wings daemon configuration at parse time. The parser serialized the entire daemon configuration object to JSON before resolving placeholders, exposing every field, including secrets, to template lookups. A low-privileged user who controls egg templates can therefore reference {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} and retrieve their values.

The leaked token and token_id values authenticate the Wings daemon to the Pterodactyl panel API. Exposure of docker.registries reveals credentials for private container registries used by the deployment.

Root Cause

The root cause lies in parser/parser.go, where Parse marshalled the full config.Get() structure into the JSON blob used for placeholder resolution. No allowlist restricted which configuration keys were exposed to template rendering, so any field serializable by encoding/json became reachable.

Attack Vector

An authenticated low-privileged user with the ability to influence egg configuration templates injects {{config.token}} or similar placeholders into a configuration file template. When Wings parses the template during server startup or configuration write, the placeholder resolves to the secret value and is written to a file the user can read.

// Patch: parser/parser.go - introduces an allowlisted templatableConfig
// so only non-sensitive Docker interface fields are exposed to templates.
type templatableConfig struct {
	Docker struct {
		Interface string `json:"interface"`
		Network   struct {
			Interface string `json:"interface"`
		} `json:"network"`
	} `json:"docker"`
}

func newTemplatableConfig(c *config.Configuration) templatableConfig {
	var t templatableConfig
	t.Docker.Interface = c.Docker.Network.Interface
	t.Docker.Network.Interface = c.Docker.Network.Interface
	return t
}

// Parse parses a given configuration file and updates all the values within
// as defined in the API response from the Panel.
func (f *ConfigurationFile) Parse(file ufs.File) error {
	if mb, err := json.Marshal(newTemplatableConfig(config.Get())); err != nil {
		return err
	} else {
		f.configuration = mb
	}
}

Source: GitHub Commit eb65e27

Detection Methods for CVE-2026-52855

Indicators of Compromise

Egg configuration file templates containing {{config.token}}, {{config.token_id}}, or {{config.docker.registries}} placeholders
Rendered server configuration files on disk that contain JWT-like token strings originating from the Wings daemon
Unexpected authenticated API calls to the Pterodactyl panel from IP addresses associated with tenant game servers

Detection Strategies

Audit all egg definitions and their config_files templates for config. placeholders that reference non-Docker fields.
Inspect rendered configuration files inside server volumes for strings resembling the Wings daemon token or registry credentials.
Correlate panel API access logs against expected daemon source addresses to identify token reuse from unauthorized hosts.

Monitoring Recommendations

Log and review any changes to egg templates in the Pterodactyl panel, especially by non-administrative users.
Monitor Wings daemon logs for template parsing operations that reference unexpected configuration paths.
Alert on outbound Docker registry authentication attempts originating from unusual hosts using the daemon's registry credentials.

How to Mitigate CVE-2026-52855

Immediate Actions Required

Upgrade Wings to version 1.12.3 or later on every node in the deployment.
Rotate the Wings daemon token and token_id values in the Pterodactyl panel after upgrading.
Rotate any Docker registry credentials configured under docker.registries in the Wings configuration.
Review historical egg templates and rendered configuration files for prior exfiltration of secrets.

Patch Information

The fix is available in Pterodactyl Wings v1.12.3. The patch introduces a templatableConfig struct that exposes only Docker interface fields to template rendering. Details are documented in GHSA-pfvc-3p5h-x7h6 and the upstream commit.

Workarounds

Restrict egg creation and modification privileges to trusted administrators until the upgrade is complete.
Review and remove any user-supplied egg templates that reference {{config.*}} placeholders outside the Docker interface fields.
Isolate untrusted tenants onto dedicated Wings nodes that hold no reusable secrets.

bash

# Upgrade Wings to the patched release
systemctl stop wings
curl -L -o /usr/local/bin/wings \
  https://github.com/pterodactyl/wings/releases/download/v1.12.3/wings_linux_amd64
chmod u+x /usr/local/bin/wings
systemctl start wings

# Verify installed version
wings --version