CVE-2026-52855: Wings Package Exposes Sensitive Node Configuration Secrets
Summary
CVE-2026-52855: Wings exposes node configuration secrets through egg configuration-file templating. Affects github.com/pterodactyl/wings versions < 1.12.3. Fixed in 1.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Wings is a daemon used in the Pterodactyl ecosystem, primarily for managing game servers. It allows users to deploy and manage their game servers with ease, providing features such as resource management, server configuration, and user management. However, a critical vulnerability has been identified that exposes sensitive configuration details, potentially leading to privilege escalation and full node compromise.
Vulnerability Detail
The vulnerability arises from Wings exposing its entire daemon configuration to the egg configuration-file templating engine. When Wings processes a server's configuration files, any placeholder in a replacement value is resolved against the full marshalled daemon configuration without restrictions. This allows low-privileged users to inject placeholders that can read sensitive information, including the node's daemon token and container-registry credentials. The result is a significant security risk, as an attacker can forge authentication tokens and gain unauthorized access to all servers on the node.
How To Fix
Latest published version: v1.13.4 as of 22 Oct 2026
go get github.com/pterodactyl/wings@v1.13.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.3
This is the first release that contains the fix.
go get github.com/pterodactyl/wings@v1.12.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
For operators unable to upgrade immediately, it is recommended to audit your eggs and ensure that no user-editable variable is rendered into a configuration file. Alternatively, mark such variables as non-editable to reduce exposure, although this is not a complete fix.
Conclusion
The CVE-2026-52855 vulnerability in the Wings package poses a significant risk by exposing sensitive configuration details to low-privileged users. It is crucial for users to upgrade to version 1.12.3 or later and rotate their daemon tokens to mitigate this risk. Additionally, auditing egg variables can help reduce exposure until an upgrade is possible.
See every vulnerability recorded for github.com/pterodactyl/wings →
FAQ
CVE-2026-52855 is a critical vulnerability in the Wings package that allows low-privileged users to access sensitive node configuration secrets.
If a user with limited privileges can set egg variable values, they may exploit this vulnerability to read sensitive information, leading to potential full node compromise.
You should audit your eggs to ensure no user-editable variables are rendered into configuration files or mark such variables as non-editable to mitigate risk.
An attacker can forge authentication tokens using the exposed daemon token, allowing them to act against every server on the node, leading to a complete compromise.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities in your software. You can check if your application is affected by this vulnerability using the Vulert playground without any signup.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pterodactyl/wings.
