CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating
Low-privileged users can read sensitive daemon configuration secrets via egg template placeholders in Wings.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52855?
CVE-2026-52855 is a critical vulnerability in pterodactyl wings, published on 31 Jul 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.
Which versions are affected by CVE-2026-52855?
3 open source packages ship an affected version, including github.com/pterodactyl/wings.
| Package | Affected | Fixed in |
|---|---|---|
github.com/pterodactyl/wings Go | All versions | 1.12.3 |
github.com/pterodactyl/wings Go | All versions | 1.12.3 |
github.com/pterodactyl/wings Go | All versions | 1.12.3 |
How do I fix CVE-2026-52855?
Upgrade github.com/pterodactyl/wings to 1.12.3 or later.
Is CVE-2026-52855 being exploited?
There is no known exploitation of CVE-2026-52855 in the wild and no public exploit code.
Sources
Also known as GHSA-pfvc-3p5h-x7h6, GO-2026-6158.