# CVE-2026-52855: Pterodactyl Wings sensitive information disclosure in egg templates

Source: https://junglewise.ai/threats/cve-2026-52855-pterodactyl-wings-sensitive-information-disclosure-in-egg  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-52855 · Severity: critical · CVSS 9.9 · Published 2026-07-31

Pterodactyl Wings, the control plane for managing game servers, contains a vulnerability that allows low-privileged users to steal sensitive administrative credentials. By placing specific placeholders in server configuration files, a user can trick the system into revealing the master daemon token and other secrets. An attacker with this token can gain full control over every game server hosted on the affected node, leading to a complete compromise of the hosting environment and all customer data on that machine.

Technologies: [github.com/pterodactyl/wings (Go)](https://junglewise.ai/threats/technologies/github-com-pterodactyl-wings), [Pterodactyl Wings](https://junglewise.ai/threats/technologies/wings). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Pterodactyl](https://junglewise.ai/threats/vendors/pterodactyl).

## Quick answers

**Is CVE-2026-52855 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52855 being exploited in the wild.

**How severe is CVE-2026-52855?** Critical severity, with a CVSS score of 9.9, published 31 July 2026.

**Which products and versions are affected?** github.com/pterodactyl/wings (Go) < 1.12.3, SEMVER:introduced=0,fixed=1.12.3; Pterodactyl Wings < 1.12.3.

**Is there a fix for CVE-2026-52855?** Yes. github.com/pterodactyl/wings (Go): upgrade to 1.12.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52855 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-52855?** Check whether you run github.com/pterodactyl/wings (Go) or Pterodactyl Wings at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/pterodactyl/wings (Go): upgrade to 1.12.3 or later

  ```sh
  go get github.com/pterodactyl/wings@v1.12.3
  ```


## Technical details

A information disclosure vulnerability exists in Pterodactyl Wings prior to version 1.12.3 due to improper restriction of template placeholders. The Wings daemon exposes its entire marshalled configuration to the egg configuration-file templating engine. A low-privileged user (such as a server owner or subuser with startup.update permissions) can smuggle '{{config.*}}' placeholders through user-controlled egg variables. When Wings renders these templates, it resolves the placeholders against the full daemon configuration and writes the resulting secrets—including the node's daemon token (used for API authentication and JWT signing) and Docker registry credentials—into files accessible via SFTP or the file manager. This allows for a complete node compromise. The issue is fixed in version 1.12.3 by restricting the templating engine to a non-secret subset of the configuration.

## Affected products

- Pterodactyl Wings < 1.12.3

## Identifiers

- CVE-2026-52855
- GHSA-pfvc-3p5h-x7h6
- GO-2026-6158

## Timeline

- 2026-05-29: patched: Version 1.12.3 released
- 2026-06-12: advisory: GitHub Security Advisory published
- 2026-07-31: disclosed: CVE published to NVD

## References

- [https://github.com/pterodactyl/wings/commit/eb65e27ae077a63e38518c490768486af1cd86a9](https://github.com/pterodactyl/wings/commit/eb65e27ae077a63e38518c490768486af1cd86a9)
- [https://github.com/pterodactyl/wings/releases/tag/v1.12.3](https://github.com/pterodactyl/wings/releases/tag/v1.12.3)
- [https://github.com/pterodactyl/wings/security/advisories/GHSA-pfvc-3p5h-x7h6](https://github.com/pterodactyl/wings/security/advisories/GHSA-pfvc-3p5h-x7h6)

## Related threats

- [Pterodactyl Wings SFTP disk quota enforcement bypass](https://junglewise.ai/threats/cve-2026-61617-pterodactyl-wings-sftp-disk-quota-enforcement-bypass)
- [Pterodactyl Wings denial of service in SFTP handshake](https://junglewise.ai/threats/cve-2026-52856-pterodactyl-wings-denial-of-service-in-sftp-handshake)
- [Pterodactyl Wings memory exhaustion in configuration file parsers](https://junglewise.ai/threats/cve-2026-52857-pterodactyl-wings-memory-exhaustion-in-configuration-file-parsers)
- [Pterodactyl Panel and Wings privilege escalation via JWT scope reuse](https://junglewise.ai/threats/cve-2026-54593-pterodactyl-panel-and-wings-privilege-escalation-via-jwt-scope)
- [GO-2026-5814 - Pterodactyl Wings: Chmod operation can be used to change permissions of files outside of the server…](https://junglewise.ai/threats/go-2026-5814-pterodactyl-wings-chmod-operation-can-be-used-to-change-10b15da7)