Is CVE-2026-52855 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52855 being exploited in the wild.

How severe is CVE-2026-52855?

Critical severity, with a CVSS score of 9.9, published 31 July 2026.

Which products and versions are affected?

github.com/pterodactyl/wings (Go) < 1.12.3, SEMVER:introduced=0,fixed=1.12.3; Pterodactyl Wings < 1.12.3.

Is there a fix for CVE-2026-52855?

Yes. github.com/pterodactyl/wings (Go): upgrade to 1.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52855 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-52855?

Check whether you run github.com/pterodactyl/wings (Go) or Pterodactyl Wings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52855: Pterodactyl Wings sensitive information disclosure in egg templates

Q: Is there a fix for CVE-2026-52855?

Yes. github.com/pterodactyl/wings (Go): upgrade to 1.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-52855 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-52855?

Check whether you run github.com/pterodactyl/wings (Go) or Pterodactyl Wings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52855 · Severity: critical · CVSS 9.9 · Published 2026-07-31

Pterodactyl Wings, the control plane for managing game servers, contains a vulnerability that allows low-privileged users to steal sensitive administrative credentials. By placing specific placeholders in server configuration files, a user can trick the system into revealing the master daemon token and other secrets. An attacker with this token can gain full control over every game server hosted on the affected node, leading to a complete compromise of the hosting environment and all customer data on that machine.

Technologies: github.com/pterodactyl/wings (Go), Pterodactyl Wings. Vendors: Go, Pterodactyl.

Quick answers

Is CVE-2026-52855 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52855 being exploited in the wild.
How severe is CVE-2026-52855?: Critical severity, with a CVSS score of 9.9, published 31 July 2026.
Which products and versions are affected?: github.com/pterodactyl/wings (Go) < 1.12.3, SEMVER:introduced=0,fixed=1.12.3; Pterodactyl Wings < 1.12.3.
Is there a fix for CVE-2026-52855?: Yes. github.com/pterodactyl/wings (Go): upgrade to 1.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52855 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-52855?: Check whether you run github.com/pterodactyl/wings (Go) or Pterodactyl Wings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

github.com/pterodactyl/wings (Go): upgrade to 1.12.3 or later
```
go get github.com/pterodactyl/wings@v1.12.3
```

Technical details

A information disclosure vulnerability exists in Pterodactyl Wings prior to version 1.12.3 due to improper restriction of template placeholders. The Wings daemon exposes its entire marshalled configuration to the egg configuration-file templating engine. A low-privileged user (such as a server owner or subuser with startup.update permissions) can smuggle '{{config.*}}' placeholders through user-controlled egg variables. When Wings renders these templates, it resolves the placeholders against the full daemon configuration and writes the resulting secrets—including the node's daemon token (used for API authentication and JWT signing) and Docker registry credentials—into files accessible via SFTP or the file manager. This allows for a complete node compromise. The issue is fixed in version 1.12.3 by restricting the templating engine to a non-secret subset of the configuration.

Affected products

Pterodactyl Wings < 1.12.3

Identifiers

CVE-2026-52855
GHSA-pfvc-3p5h-x7h6
GO-2026-6158

Timeline

2026-05-29: patched: Version 1.12.3 released
2026-06-12: advisory: GitHub Security Advisory published
2026-07-31: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.