CVE-2026-52855: Pterodactyl Wings Template Vulnerability
TL;DR - Pterodactyl Wings before 1.12.3 can expose sensitive daemon configuration via
{{config.}}placeholders. - Low-privileged users may read token and Docker registry-related values through egg templates. - Upgrade to Wings 1.12.3 immediately; public exploitation is not confirmed, but impact is high.
Vulnerability at a Glance
| Field | Value |
|---|---|
| CVE ID | CVE-2026-52855 |
| CVSS | 9.9 (NVD base score) |
| Attack vector | Not explicitly published; attacker must influence egg configuration-file templates as a low-privileged user |
| Privileges required | Low |
| Patch available | Yes, fixed in Pterodactyl Wings 1.12.3 |
CVE-2026-52855 is a critical-severity information disclosure flaw in Pterodactyl Wings, the daemon component used by the Pterodactyl game server management platform. According to the NVD description, Wings versions prior to 1.12.3 allow {{config.}} placeholders in egg configuration-file templates to resolve against the full daemon configuration.
That behavior matters because it exposes values that should remain internal to the daemon, including {{config.token}}, {{config.token_id}}, and {{config.docker.registries}}. Even though this is not described as direct remote code execution, disclosure of authentication and infrastructure configuration can materially increase the likelihood of follow-on compromise.
What Is This Vulnerability?
The root cause is overly broad template variable resolution in Wings. Egg configuration-file templates support placeholders, but in affected versions, the {{config.}} namespace could be used to access the daemon’s full configuration rather than a restricted, safe subset intended for template rendering.
In practice, that means a low-privileged user who can interact with or supply content through an egg configuration-file template may be able to retrieve sensitive configuration data that the application should never expose at that privilege level. The NVD record specifically names config.token, config.token_id, and config.docker.registries as exposed values.
This is best understood as an authorization and data exposure failure in the template rendering path. The vulnerability is not that the data exists, but that Wings prior to 1.12.3 did not sufficiently constrain what the template engine could resolve from daemon configuration. That distinction is important for defenders because the risk comes from seemingly legitimate application behavior, not necessarily from malformed packets or memory corruption.
The downstream impact depends on how the disclosed values are used in a given environment. Token material may enable unauthorized API interaction or administrative workflows if reused directly. Docker registry configuration can reveal private registry endpoints, credentials handling patterns, or deployment details useful for lateral movement and targeting.
Technical Notes
The upstream fix reference indicates a code change in the Wings repository addressing this placeholder handling issue:
Fix commit:
https://github.com/pterodactyl/wings/commit/eb65e27ae077a63e38518c490768486af1cd86a9
Sensitive values named in the public description include:
{{config.token}}
{{config.token_id}}
{{config.docker.registries}}
Who Is Affected?
The affected product is Pterodactyl Wings, specifically all versions prior to 1.12.3. The fixed version explicitly identified by the NVD record and upstream release references is 1.12.3. If you are running Wings 1.12.2 or older, you should treat the instance as affected unless you have independently verified a backported fix from your package source.
The available source material does not narrow the issue to a specific operating system, Linux distribution package, or deployment model. Because Wings commonly runs as a daemon behind the Pterodactyl panel and interfaces with game server instances and containerized workloads, both self-hosted and SMB environments using custom eggs should review exposure carefully.
Organizations most at risk are those where low-privileged tenants, delegated administrators, or untrusted game server operators can influence egg templates or consume generated configuration files. In multi-tenant game hosting setups, that is a realistic model: a flaw that leaks daemon-level configuration to a lower-privileged user can cross tenant and control-plane boundaries.
If you do not know your Wings version, assume exposure until confirmed otherwise. Package lag is common when software is installed from third-party repositories, custom automation, or manually managed binaries.
Technical Notes
Check the installed Wings version locally:
wings version
If the binary is managed by systemd and the direct version subcommand is unavailable in your environment, verify the deployed binary or package metadata:
/usr/local/bin/wings version
dpkg -l | grep -i wings
rpm -qa | grep -i wings
CVSS Score Breakdown
The NVD record reports a CVSS v3.x base score of 9.9, but the full vector string was not included in the research note. Because the vector is not available here, defenders should avoid assuming precise metric values beyond what the source confirms: the issue is rated near-critical by NVD.
Even without the complete vector, the published description explains why the score is high. The vulnerability allows a low-privileged actor to obtain sensitive daemon configuration, including token-related values. That combination usually raises the confidentiality impact significantly, especially when exposed secrets may enable further access. In environments where token disclosure directly enables administrative control or access to private registries, the operational impact can exceed what “information disclosure” might suggest at first glance.
The one component we can state confidently from the description is that privileges are required, but only low privileges. The attack path is therefore not equivalent to a completely unauthenticated internet-wide exploit, yet it is still serious in shared hosting and delegated administration contexts. This is exactly the kind of flaw that can turn a normal tenant account into a stepping stone toward control-plane compromise.
Because the vector is not published in the provided source set, defenders should assume worst-case practical impact for any deployment where low-privileged users can interact with eggs or generated config. That is a safer assumption than minimizing the issue based on incomplete scoring metadata.
Exploitation Status
As of 2026-07-31, active exploitation in the wild is not confirmed from the sources provided. The CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, which means there is no CISA confirmation of observed exploitation at this time.
A public proof of concept was not identified in the primary references cited in the research note. The known references are the NVD entry, the upstream fix commit, the GitHub release for v1.12.3, and the GitHub Security Advisory. None of those, by themselves, establish public exploit code or active in-the-wild attacks.
Defenders should not overread that absence. “Not on KEV” is not proof of safety, and “no public PoC identified” is not proof that exploitation is difficult. In this case, the vulnerability description is specific enough that a capable user with access to the product may be able to reproduce it without much ambiguity. That makes rapid patching the right response even without public exploitation evidence.
For exposed multi-tenant Wings deployments, especially those with untrusted or semi-trusted users, it is reasonable to treat this as a high-priority patch due to the low-privilege requirement and the sensitivity of the disclosed values.
How to Detect It
Detection for this issue is not as straightforward as signature-based exploitation of a memory corruption bug because the vulnerable behavior may occur through ordinary application workflows. The most practical approach is to look for attempts to include {{config. placeholders in egg configuration-file templates, generated config payloads, or related administrative actions.
You should also review whether any low-privileged users recently edited eggs, startup definitions, or configuration templates and then correlate that activity with unexpected token use, registry access, or other follow-on authentication events. If sensitive values were exposed, the initial evidence may be subtle, while the later abuse appears in access logs or API activity.
If your logging does not currently capture template content or egg modifications, assume possible historical blind spots. In that case, prioritize patching, rotate exposed tokens if applicable, and inspect daemon and panel audit trails for suspicious changes tied to lower-privileged accounts.
Technical Notes
Look for suspicious placeholder strings in Wings, panel, deployment, or configuration repositories:
grep -R "{{config\.}}" /etc/pterodactyl /var/lib/pterodactyl /srv/pterodactyl 2>/dev/null
A simple log hunting pattern for centralized logging is any event containing the placeholder namespace:
"{{config."
Example Splunk query:
index=* (source=*pterodactyl* OR source=*wings*) "{{config."
| stats count by host, source, user, _time
Example grep against journal logs:
journalctl -u wings --since "30 days ago" | grep -F "{{config."
If your environment logs HTTP requests to the panel or an upstream reverse proxy, review for requests associated with egg or template editing followed by unusual token-related access. Because exact routes can vary by deployment and logging format, focus on sequences involving template modification plus authentication activity from the same account or IP.
Mitigation and Patching
The primary remediation is to upgrade Pterodactyl Wings to version 1.12.3. The NVD description is explicit: versions prior to 1.12.3 are affected, and 1.12.3 contains the fix. If you are using a package maintained by a third party, verify that it specifically includes the upstream 1.12.3 fix and is not simply labeled as patched without reference to the commit or release.
If immediate upgrade is not possible, reduce exposure by restricting who can modify or use egg configuration-file templates, reviewing all existing templates for {{config.}} placeholder abuse, and rotating any daemon tokens or registry-related secrets that may have been disclosed. These are compensating controls, not complete fixes, because the root problem is in the daemon’s placeholder resolution behavior.
Where practical, review and sanitize custom eggs before re-enabling lower-privileged editing workflows. Also consider temporarily limiting multi-tenant template customization until all Wings nodes are confirmed on 1.12.3. If Docker registry configuration may have been exposed, validate whether any private registry credentials or endpoints require rotation or access review.
Technical Notes
Upgrade using the release referenced by upstream:
Fixed release:
https://github.com/pterodactyl/wings/releases/tag/v1.12.3
Generic binary replacement workflow for self-managed Linux deployments:
sudo systemctl stop wings
# Replace with the v1.12.3 binary appropriate for your platform from the official release.
sudo install -m 755 wings /usr/local/bin/wings
sudo systemctl start wings
/usr/local/bin/wings version
If you need a temporary workaround while planning the upgrade, identify and remove unsafe placeholders from templates:
grep -R "{{config\.}}" /etc/pterodactyl /var/lib/pterodactyl /srv/pterodactyl 2>/dev/null
Then rotate potentially exposed values according to your local deployment process. The exact token rotation steps are deployment-specific and are not documented in the provided source material, so defenders should use their internal Pterodactyl/Wings credential management procedure rather than improvising changes on production nodes.
References
The primary authoritative source is the NVD entry for CVE-2026-52855, which provides the vulnerability description, severity score, affected range, and fixed version. For technical validation, the upstream GitHub repository, release page for Wings v1.12.3, and the linked fix commit are the key sources defenders should review.
The GitHub Security Advisory is also relevant because it ties the issue back to the upstream maintainers and provides a canonical product-level reference point. For exploitation status, the absence of the CVE from the CISA KEV catalog supports only one conclusion: there is no current CISA-confirmed known exploitation listing.
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-52855
- GitHub Security Advisory: https://github.com/pterodactyl/wings/security/advisories/GHSA-pfvc-3p5h-x7h6
- Fix commit: https://github.com/pterodactyl/wings/commit/eb65e27ae077a63e38518c490768486af1cd86a9
- Fixed release v1.12.3: https://github.com/pterodactyl/wings/releases/tag/v1.12.3
- Official Wings repository: https://github.com/pterodactyl/wings
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
For defenders, the key takeaway is straightforward: if you run Pterodactyl Wings before 1.12.3, patch now, review egg templates for {{config.}} abuse, and assess whether daemon token or Docker registry-related data may already have been disclosed.
For more information on patch management, check out our articles on Patch Tuesday and Third-Party Risk Management Best Practices.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.