Summary
Wings exposes node configuration secrets through egg configuration-file templating
Workarounds
For operators who cannot upgrade immediately:
- Audit your eggs and ensure no user-editable variable is rendered into a
configuration file, or mark such variables non-editable.
These reduce exposure but are not a complete fix; upgrading Wings is the
recommended action.
Impact
Type: Exposure of sensitive information / insufficiently protected credentials
leading to privilege escalation and full node compromise.
Wings exposes its entire daemon configuration to the egg configuration-file
templating engine. When Wings renders a server's configuration files, any{{config.<path>}} placeholder in a replacement value is resolved against the
full marshalled daemon configuration, with no restriction on which paths may be
read.
Because the Panel substitutes user-controlled egg variable values into these
replacements before sending them to Wings, a low-privileged user can smuggle a{{config.*}} placeholder through a variable value. The placeholder is then
resolved by Wings and written into a file inside the user's own server, where it
can be read via the file manager or SFTP.
This allows reading, among other values:
{{config.token}}- the node's daemon token, which is both the API bearer for
the Panel⇆Wings channel and the HMAC signing key for every JWT the node
issues;{{config.token_id}};{{config.docker.registries}}- configured container-registry credentials.
Who is impacted: Any deployment where a user who is not fully trusted can set
an egg variable value (e.g. a server owner or a subuser with the startup.update
permission) and the server's egg renders a user-editable variable into a
configuration file via {{server.build.env.*}}. This pattern is common across
stock and community eggs, so most multi-tenant / shared-hosting deployments are
affected.
Resulting impact: Disclosure of the node daemon token lets the attacker forge
authentication tokens and act against every server on that node, a full-node compromise reachable from a low-privileged
account.
CVE-2026-52855 has a CVSS score of 9.9 (Critical). The vector is network-reachable, low privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.12.3); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Yes. Fixed in Wings v1.12.3 (Panel is unaffected; the fix is Wings-only).
Wings no longer exposes its full configuration to the templating engine only an
explicit, non-secret subset (the Docker network interface) can be resolved by{{config.*}} placeholders.
Users should upgrade Wings to v1.12.3 or later.
After upgrading, rotate the affected nodes' daemon tokens, since a previously
exfiltrated token remains valid until rotated (Admin → Nodes → Configuration →
reset the token, then re-deploy config.yml to the node).
Frequently Asked Questions
- What is CVE-2026-52855? CVE-2026-52855 is a critical-severity security vulnerability in github.com/pterodactyl/wings (go), affecting versions < 1.12.3. It is fixed in 1.12.3.
- How severe is CVE-2026-52855? CVE-2026-52855 has a CVSS score of 9.9 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/pterodactyl/wings are affected by CVE-2026-52855? github.com/pterodactyl/wings (go) versions < 1.12.3 is affected.
- Is there a fix for CVE-2026-52855? Yes. CVE-2026-52855 is fixed in 1.12.3. Upgrade to this version or later.
- Is CVE-2026-52855 exploitable, and should I be worried? Whether CVE-2026-52855 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-52855 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-52855? Upgrade
github.com/pterodactyl/wingsto 1.12.3 or later.