CVE-2026-52855 with a CVSS score of 9.9 is a critical vulnerability affecting github.com/pterodactyl/wings versions < 1.12.3 that allows exposure of sensitive information and insufficiently protected credentials, leading to privilege escalation and full node compromise. Wings exposes its entire daemon configuration to the egg configuration-file templating engine, allowing a low-privileged user to smuggle a {config.*} placeholder through a variable value. This allows reading values such as the node's daemon token, which is both the API bearer for the Panel⇆Wings channel and the HMAC signing key for every JWT the node issues. The vulnerability affects any deployment where a user who is not fully trusted can set an egg variable value and the server's egg renders a user-editable variable into a configuration file via {server.build.env.*}. This pattern is common across stock and community eggs, so most multi-tenant / shared-hosting deployments are affected. Disclosure of the node daemon token lets the attacker forge authentication tokens and act against every server on that node, a full-node compromise reachable from a low-privileged account.
We recommend you to upgrade Wings to version 1.12.3.[/subscribe_to_unlock_form]
CVE-2026-52855 with a CVSS score of 9.9 is a critical vulnerability affecting github.com/pterodactyl/wings versions < 1.12.3 that allows exposure of sensitive information and insufficiently protected credentials, leading to privilege escalation and full node compromise. Wings exposes its entire daemon configuration to the egg configuration-file templating engine, allowing a low-privileged user to smuggle a {config.*} placeholder through a variable value. This allows reading values such as the node's daemon token, which is both the API bearer for the Panel⇆Wings channel and the HMAC signing key for every JWT the node issues. The vulnerability affects any deployment where a user who is not fully trusted can set an egg variable value and the server's egg renders a user-editable variable into a configuration file via {server.build.env.*}. This pattern is common across stock and community eggs, so most multi-tenant / shared-hosting deployments are affected. Disclosure of the node daemon token lets the attacker forge authentication tokens and act against every server on that node, a full-node compromise reachable from a low-privileged account.
We recommend you to upgrade Wings to version 1.12.3.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]