Pterodactyl Wings Egg Configuration-File Templating Node Secret Exposure (CVE-2026-52855)

let SuspiciousEggKeywords = dynamic(["config.token", "daemon_token", "docker.socket", "sftp.password", "authentication_token", "panel_secret"]);
ContainerLogV1
| where ContainerImageName has "wings" or ContainerName has "wings"
| where LogMessage has_any ("egg", "config-file template", "config file render")
| where LogMessage has_any (SuspiciousEggKeywords)
| extend NodeName = tostring(split(ContainerName, "_")[0])
| project TimeGenerated, NodeName, ContainerName, LogMessage
| order by TimeGenerated desc

index=wings sourcetype=wings:daemon ("config-file" OR "egg" OR "template") 
("config.token" OR "daemon_token" OR "docker.socket" OR "sftp.password" OR "authentication_token" OR "panel_secret")
| eval node=coalesce(node_name, host)
| stats count min(_time) as first_seen max(_time) as last_seen by node, server_uuid, user
| where count > 0
| sort - last_seen

any where event.dataset == "wings.daemon" and
  (message like "*config-file*" or message like "*egg*template*") and
  (message like "*config.token*" or message like "*daemon_token*" or message like "*docker.socket*" or message like "*sftp.password*" or message like "*authentication_token*" or message like "*panel_secret*")

SELECT DATEFORMAT(devicetime, 'YYYY-MM-dd HH:mm:ss') as EventTime, sourceip, "Node Name", UTF8(payload) as RawLog
FROM events
WHERE LOGSOURCETYPENAME(devicetype) = 'Wings Daemon'
AND (UTF8(payload) ILIKE '%config-file%' OR UTF8(payload) ILIKE '%egg%template%')
AND (UTF8(payload) ILIKE '%config.token%' OR UTF8(payload) ILIKE '%daemon_token%' OR UTF8(payload) ILIKE '%docker.socket%' OR UTF8(payload) ILIKE '%sftp.password%' OR UTF8(payload) ILIKE '%authentication_token%' OR UTF8(payload) ILIKE '%panel_secret%')
LAST 24 HOURS

_sourceCategory=wings/daemon
("config-file" OR "egg" AND "template")
and ("config.token" or "daemon_token" or "docker.socket" or "sftp.password" or "authentication_token" or "panel_secret")
| parse "node=*" as node_name nodrop
| parse "server_uuid=*" as server_uuid nodrop
| count by node_name, server_uuid
| sort by _count

rule wings_egg_config_secret_exposure {
  meta:
    author = "df00tech detection engineering"
    description = "Detects Wings daemon egg config-file template rendering events exposing node secrets (CVE-2026-52855)"
    severity = "CRITICAL"
    cve = "CVE-2026-52855"
  events:
    $log.metadata.event_type = "GENERIC_EVENT"
    $log.metadata.product_name = "Pterodactyl Wings"
    $log.principal.application = "wings"
    re.regex($log.security_result.summary, `(?i)(config-file|egg.*template)`)
    re.regex($log.security_result.summary, `(?i)(config\.token|daemon_token|docker\.socket|sftp\.password|authentication_token|panel_secret)`)
  condition:
    $log
}

#event_simple_name=ProcessRollup2 OR #event_simple_name=ApplicationLog
| ImageFileName="*wings*"
| RawProcessCommandLine=/config-file|egg.*template/i OR LogMessage=/config-file|egg.*template/i
| (RawProcessCommandLine=/config\.token|daemon_token|docker\.socket|sftp\.password|authentication_token|panel_secret/i OR LogMessage=/config\.token|daemon_token|docker\.socket|sftp\.password|authentication_token|panel_secret/i)
| table([timestamp, ComputerName, ImageFileName, RawProcessCommandLine, LogMessage])