CVE-2026-52855
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Wings, the server control plane for Pterodactyl, prior to 1.12.3 allows a low-privileged user to read sensitive configuration data (token, token_id, Docker registries) via {{config.}} placeholders in egg configuration-file templates.
Risk Assessment
Exposure of tokens and credentials may lead to compromise of the daemon and game servers.
Recommendation
Update Wings to version 1.12.3 or later.
Other vulnerabilities in Wings
See all- CVE-2026-61617High
Wings (the server control plane for Pterodactyl) versions up to and including 1.13.2 do not enforce a server's disk quota during an SFTP transfer, allowing a tenant with SFTP write access to exhaust the host node's physical disk and take down every server on it. Available space is checked only once, when the write handle is opened, using a stale cached value and without knowing the size of the incoming data.
- CVE-2026-52856High
Wings, the server control plane for Pterodactyl, prior to version 1.13.0 contains a vulnerability causing a Go panic due to a malformed packet received during the SFTP connection handshake. This issue is fixed in version 1.13.0.
- CVE-2026-52857Medium
Wings, the server control plane for Pterodactyl, prior to version 1.13.0 has unbounded JSON, YAML, and XML configuration file parsers. They can process an oversized configuration file and exhaust Wings process memory.
Original NVD description (English source)
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.