Detect Pterodactyl Wings Egg Configuration-File Templating Node Secret Exposure (CVE-2026-52855) in IBM QRadar
Detects exploitation of CVE-2026-52855, a critical (CVSS 9.9) information disclosure vulnerability in Pterodactyl Wings prior to 1.12.3. The Wings daemon's egg configuration-file templating engine fails to properly scope variable substitution, allowing a malicious or crafted egg/server configuration to reference and render node-level secrets (e.g., the Wings daemon token, SFTP credentials, Docker/panel authentication secrets) into server-accessible configuration files. An attacker with the ability to create or modify an egg (via panel admin compromise, supply-chain egg import, or a malicious server owner in multi-tenant environments) can exfiltrate node configuration secrets, leading to full node takeover. Detection focuses on Wings daemon logs showing configuration-file template rendering events that reference sensitive node config keys, unexpected egg install/import activity, and outbound access to rendered server config files containing daemon secrets.
MITRE ATT&CK
QRadar Detection Query
SELECT DATEFORMAT(devicetime, 'YYYY-MM-dd HH:mm:ss') as EventTime, sourceip, "Node Name", UTF8(payload) as RawLog
FROM events
WHERE LOGSOURCETYPENAME(devicetype) = 'Wings Daemon'
AND (UTF8(payload) ILIKE '%config-file%' OR UTF8(payload) ILIKE '%egg%template%')
AND (UTF8(payload) ILIKE '%config.token%' OR UTF8(payload) ILIKE '%daemon_token%' OR UTF8(payload) ILIKE '%docker.socket%' OR UTF8(payload) ILIKE '%sftp.password%' OR UTF8(payload) ILIKE '%authentication_token%' OR UTF8(payload) ILIKE '%panel_secret%')
LAST 24 HOURSQueries QRadar for Wings daemon log events showing egg config-file template rendering referencing node secret keys, indicative of CVE-2026-52855 exploitation.
Data Sources
Required Tables
False Positives & Tuning
- Developer debug sessions rendering egg templates on test nodes
- Automated egg import/validation pipelines
Other platforms for CVE-2026-52855
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Simulate malicious egg config_files template referencing secret key
Expected signal: Wings daemon logs recording config-file template rendering for the test egg, including reference to the config.token variable
- Test 2Render server config and inspect for exposed daemon secret
Expected signal: File write event on server.properties under the server volume, plus Wings daemon log entry for config sync of the test server
- Test 3Verify unpatched Wings version is vulnerable
Expected signal: Command execution log/audit entry for the wings version check on the lab host
Response Playbook
Triage
- Identify the affected Wings node version via `wings version` or the panel's node listing; confirm it is < 1.12.3.
- Review recent egg imports/edits in the panel admin area (Nests > Eggs) for unauthorized or unfamiliar eggs, focusing on the 'startup' and 'config_files' templating sections.
- Inspect Wings daemon logs and rendered server configuration files (typically under /var/lib/pterodactyl/volumes/<server-uuid>) for the presence of node secrets such as daemon tokens, SFTP passwords, or Docker socket paths.
- Correlate egg creation/modification timestamps with panel admin account activity and API key usage to identify the source of a malicious egg.
Containment
- Immediately upgrade Wings to version 1.12.3 or later on all nodes to eliminate the templating vulnerability.
- Rotate the Wings daemon token, SFTP credentials, and any other node secrets that may have been exposed via rendered configuration files, then redistribute updated credentials to the panel.
Evidence Collection
- Preserve copies of the suspicious egg's configuration (startup command, config_files templating JSON) and the resulting rendered server config files before remediation.
- Export Wings daemon logs covering the suspected exploitation window, along with panel audit logs showing who created/imported/modified the malicious egg.
Escalation Criteria
- !Escalate to incident response if rendered secrets (daemon token, Docker socket access) were confirmed present in a server-accessible file, since this can lead to full node/host compromise.
- !Escalate if the malicious egg was distributed to or executed on multiple nodes/servers, indicating a broader multi-tenant compromise requiring cross-node credential rotation.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Rendered server configuration files under the server's data directory containing unexpected secret values - >
Wings daemon log entries showing config-file template variable resolution for the affected egg - >
Panel audit log entries for egg creation, import, or modification actions
Tuning Guidance
Baseline normal egg-development and QA activity for your environment to reduce false positives from legitimate template debugging. Restrict keyword matching to production nodes only, and enrich alerts with the identity of the panel user who last modified the triggering egg to speed triage. Consider suppressing alerts from known CI/CD service accounts performing automated egg validation, provided those pipelines run in isolated, non-production Wings instances.
Hunting Queries
Broad hunt across Wings logs for any config_files templating events referencing secret-like keywords, to catch variants or partial exploitation attempts not matched by the primary detection.
ContainerLogV1
| where ContainerName has "wings"
| where LogMessage has "config_files" and LogMessage has_any ("token", "secret", "password")
| project TimeGenerated, ContainerName, LogMessageindex=wings sourcetype=wings:daemon "config_files" ("token" OR "secret" OR "password")
| table _time, host, messageAtomic Red Team Tests
Creates a test egg configuration on a lab Wings/Pterodactyl instance with a config_files templating entry that references a node-level secret variable, simulating the exploitation technique described in CVE-2026-52855.
Command
curl -s -X POST http://localhost:8080/api/application/nests/1/eggs -H 'Authorization: Bearer <lab-panel-api-key>' -H 'Content-Type: application/json' -d '{"name":"test-egg","config_files":"{\"server.properties\":{\"parser\":\"properties\",\"find\":{\"daemon-token\":\"{{config.token}}\"}}}"}'Cleanup
curl -s -X DELETE http://localhost:8080/api/application/nests/1/eggs/<created-egg-id> -H 'Authorization: Bearer <lab-panel-api-key>'Expected Telemetry
Wings daemon logs recording config-file template rendering for the test egg, including reference to the config.token variable
Expected Detection
SIEM alert fires on the Wings config-file template rendering rule due to presence of 'config.token' keyword in the rendered log entry
Triggers installation/config sync for a server using the malicious test egg on a lab node and inspects the rendered server configuration file for the presence of the Wings daemon token or other node secrets.
Command
wings diagnostics 2>/dev/null; cat /var/lib/pterodactyl/volumes/<test-server-uuid>/server.properties | grep -i tokenCleanup
rm -f /var/lib/pterodactyl/volumes/<test-server-uuid>/server.properties; systemctl restart wingsExpected Telemetry
File write event on server.properties under the server volume, plus Wings daemon log entry for config sync of the test server
Expected Detection
Hunting query flags rendered config_files event containing 'token' keyword; file integrity monitoring may also flag unexpected secret-like content
Checks the installed Wings daemon version on a lab node to confirm it is below the patched 1.12.3 release, validating exploitability before running the templating tests.
Command
wings version | grep -Eo 'v?[0-9]+\.[0-9]+\.[0-9]+'Cleanup
N/A (read-only version check)Expected Telemetry
Command execution log/audit entry for the wings version check on the lab host
Expected Detection
No direct SIEM detection expected for this reconnaissance step; used only to validate lab conditions prior to exploitation testing