Skip to content
CVE PROGRAM SOURCE RECORD9.9 Critical

CVE-2026-52855

Wings exposes node configuration secrets through egg configuration-file templating

Description

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

pterodactyl wings

  • < 1.12.3affected

References