Executive brief
Pterodactyl Wings, the control plane for managing game servers, contains a vulnerability that allows low-privileged users to steal sensitive administrative credentials. By placing specific placeholders in server configuration files, a user can trick the system into revealing the master daemon token and other secrets. An attacker with this token can gain full control over every game server hosted on the affected node, leading to a complete compromise of the hosting environment and all customer data on that machine.
Technical details
A information disclosure vulnerability exists in Pterodactyl Wings prior to version 1.12.3 due to improper restriction of template placeholders. The Wings daemon exposes its entire marshalled configuration to the egg configuration-file templating engine. A low-privileged user (such as a server owner or subuser with startup.update permissions) can smuggle '{{config.*}}' placeholders through user-controlled egg variables. When Wings renders these templates, it resolves the placeholders against the full daemon configuration and writes the resulting secrets—including the node's daemon token (used for API authentication and JWT signing) and Docker registry credentials—into files accessible via SFTP or the file manager. This allows for a complete node compromise. The issue is fixed in version 1.12.3 by restricting the templating engine to a non-secret subset of the configuration.
Affected products
- Pterodactyl Wings < 1.12.3
Timeline
- 2026-05-29: patched: Version 1.12.3 released
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD