CVE-2026-52855: Vulnerability in github.com/pterodactyl/wings Exposes Node Configuration Secrets
Summary
CVE-2026-52855: Wings exposes node configuration secrets through egg configuration-file templating in github.com/pterodactyl/wings. Affects github.com/pterodactyl/wings versions < 1.12.3. Fixed in 1.12.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
github.com/pterodactyl/wings is an open-source software package designed for managing game servers. It provides a robust framework for deploying and controlling game server instances, allowing users to manage resources efficiently. However, it has been found to expose sensitive node configuration secrets through its egg configuration-file templating, which can lead to unauthorized access and potential exploitation.
Vulnerability Detail
The vulnerability arises from the way Wings handles configuration-file templating for its eggs. Specifically, it inadvertently exposes sensitive node configuration secrets, which can be accessed by unauthorized users. This could lead to serious security implications, including unauthorized access to server configurations, potential data breaches, and exploitation of the game server environment. The issue is rooted in the templating logic that does not adequately secure sensitive information.
How To Fix
Latest published version: v1.13.4 as of 22 Oct 2026
go get github.com/pterodactyl/wings@v1.13.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.12.3
This is the first release that contains the fix.
go get github.com/pterodactyl/wings@v1.12.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually review and restrict access to the configuration files to ensure that sensitive information is not exposed. Additionally, consider implementing stricter access controls and monitoring to mitigate potential risks until the package is updated.
Conclusion
In summary, CVE-2026-52855 is a significant vulnerability in the github.com/pterodactyl/wings package that exposes sensitive node configuration secrets. It is crucial to update to version 1.12.3 or later to mitigate the risks associated with this vulnerability. Temporary workarounds can be implemented until the update is applied.
See every vulnerability recorded for github.com/pterodactyl/wings →
FAQ
CVE-2026-52855 is a vulnerability in the github.com/pterodactyl/wings package that exposes node configuration secrets through its egg configuration-file templating.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without requiring any signup.
The risks include unauthorized access to sensitive node configurations, potential data breaches, and exploitation of the game server environment.
You can update the package by running the command 'go get github.com/pterodactyl/wings@v1.12.3' in your terminal to ensure you have the patched version.
If you cannot update the package immediately, consider implementing stricter access controls and monitoring to mitigate potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/pterodactyl/wings.
