CVE-2026-52855CWE-200CWE-522information-disclosure

CVE-2026-52855

Critical · published July 31, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
42.3
In the wild
Unconfirmed
What it is

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00506 · 42.3th percentile
Weaknesses
CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor; CWE-522 · Insufficiently Protected Credentials
Published
2026-07-31T21:16Z
References (3)
https://github.com/pterodactyl/wings/commit/eb65e27ae077a63e38518c490768486af1cd86a9 · [email protected]https://github.com/pterodactyl/wings/releases/tag/v1.12.3 · [email protected]https://github.com/pterodactyl/wings/security/advisories/GHSA-pfvc-3p5h-x7h6 · [email protected]
EPSS history
Timeline
  • 31 JUL 16:16Z
    Wings exposes node configuration secrets through egg configuration-file templating
    cvelistv5