CVE-2026-52855 — Wings exposes node configuration secrets through egg configuration-file templating
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file template…
Published: 2026-07-31 · CVSS: 9.9 · CVSS 3.1
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7