CVE-2026-52855
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
Wings, the server control plane for Pterodactyl, prior to 1.12.3 allows a low-privileged user to read sensitive configuration data (token, token_id, Docker registries) via {{config.}} placeholders in egg configuration-file templates.
Risk Assessment
Exposure of tokens and credentials may lead to compromise of the daemon and game servers.
Recommendation
Update Wings to version 1.12.3 or later.
Original NVD description (English source)
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.