CVE-2026-52855
Received Received - Intake

Wings Server Control Plane Credential Exposure Vulnerability

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: GitHub, Inc.

Description
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-52855
EUVD
EUVD-2026-51568

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
pterodactyl wings to 1.12.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Wings, the server control plane for Pterodactyl, allows low-privileged users to read sensitive configuration tokens and registry details from egg configuration-file templates due to improper handling of {{config.}} placeholders. The issue is fixed in version 1.12.3.

Detection Guidance

Check Wings server version with 'wings version'. If version is below 1.12.3, the system is vulnerable. Inspect egg configuration templates for {{config.}} placeholders referencing token, token_id, or docker.registries.

Impact Analysis

An attacker could exploit this to gain access to sensitive tokens and registry credentials, potentially leading to unauthorized access, data breaches, or further compromise of the Pterodactyl environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements by exposing confidential information.

Mitigation Strategies

Upgrade Wings to version 1.12.3 or later immediately. Review and remove any {{config.}} placeholders in egg configuration templates that expose sensitive data. Restrict low-privileged user access to configuration files.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-52855. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart