CVE-2026-52855 in Wings
Summary
by MITRE • 07/31/2026
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The Wings control plane component of Pterodactyl represents a critical server management infrastructure that handles the orchestration and configuration of game servers within the platform. This vulnerability affects the daemon configuration processing system where egg templates contain placeholders that are not properly sanitized before being rendered. The flaw exists in how the system processes configuration file templates, particularly when handling {{config.}} placeholders that reference sensitive daemon-level parameters.
The technical implementation of this vulnerability stems from inadequate input validation and sanitization within the template rendering engine. When low-privileged users submit requests to modify or create server configurations through egg templates, the system fails to properly isolate or escape the placeholder variables that reference critical configuration values. This creates a path where unauthorized access can occur through carefully crafted template modifications that exploit the template engine's processing logic.
The operational impact of this vulnerability is significant as it allows attackers with minimal privileges to extract sensitive authentication tokens and registry configurations from the daemon's full configuration. These extracted credentials could enable further exploitation attempts including unauthorized access to container registries, potential privilege escalation within the daemon environment, or lateral movement attacks against other systems that rely on these tokens for authentication. The exposure of {{config.token_id}} specifically undermines the token-based authentication mechanism, while access to {{config.docker.registries}} provides insights into container image sources and potential attack vectors.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-79 Cross-Site Scripting, representing a classic case of insufficient output escaping in template processing systems. The issue demonstrates how seemingly benign template placeholder functionality can become a security risk when proper sanitization measures are not implemented. From an attack perspective, this maps to ATT&CK technique T1078 Valid Accounts and T1566 Phishing, as compromised templates could be used to harvest credentials from the configuration files.
Mitigation strategies should focus on implementing strict template variable sanitization and access controls within the Wings daemon configuration processing system. The fix in version 1.12.3 likely involves enhanced validation of placeholder variables, proper escaping of configuration values during template rendering, and implementation of least privilege principles for template processing operations. Organizations should ensure immediate upgrade to version 1.12.3 or later, conduct thorough review of existing egg templates for potential exploitation vectors, and implement monitoring for unauthorized configuration modifications. Additional protective measures include regular security auditing of template systems and implementation of principle of least privilege for user access controls within the Pterodactyl platform.