Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.9

Pterodactyl Wings may reveal secret configuration data

CVE-2026-52855 · published 2 months ago
Summary

The Wings component that runs game servers for Pterodactyl can let a low‑privilege user see internal tokens and Docker registry settings when a special placeholder is used in a server template. This exposure could let an attacker copy or misuse those credentials. Upgrade Wings to version 1.12.3 or later to stop the leakage.

What to do
  • Update github.com pterodactyl to version 1.12.3.
Affected software
Ecosystem VendorProductAffected versions
– pterodactyl wings < 1.12.3
go github.com pterodactyl < 1.12.3
Fix: upgrade to 1.12.3
Original advisory text
Wings exposes node configuration secrets through egg configuration-file templating
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.9 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
CWE-522Insufficiently Protected Credentials
Timeline
Published31 Jul 2026
Updated26 Oct 2026
First seen31 Jul 2026
Sources
CVE-2026-52855 · NVD
CVE-2026-52855 · MITRE
GHSA-pfvc-3p5h-x7h6 · GHSA
CVE-2026-52855 · OSV
Track software like this
Free during beta