Wings Configuration-Templating Flaw Lets Low-Privileged Users Steal Node Daemon Tokens (CVE-2026-52855)

A newly published GitHub Security Advisory (GHSA-pfvc-3p5h-x7h6, CVE-2026-52855, CVSS 9.9) discloses a critical vulnerability in Pterodactyl Wings, the daemon component that manages game/application servers on nodes controlled by the Pterodactyl Panel. According to the advisory, Wings exposes its entire marshalled daemon configuration to the egg configuration-file templating engine, with no restriction on which fields can be resolved via a {{config.<path>}} placeholder.

Because the Panel substitutes user-controlled egg variable values into these replacements before handing them to Wings, a low-privileged user — such as a server owner or a subuser with startup.update permission — can smuggle a {{config.*}} placeholder into a variable value. Wings then resolves it and writes the result into a file inside that user's own server, retrievable via the file manager or SFTP. The advisory notes this can expose the node's daemon token (used both as the Panel⇆Wings API bearer and as the HMAC signing key for JWTs issued by the node), the token ID, and configured Docker registry credentials.

Why It Matters

The advisory states this pattern is common across stock and community eggs, meaning most multi-tenant or shared-hosting Pterodactyl deployments are affected. Exfiltration of the node daemon token would let an attacker forge authentication tokens and act against every server hosted on that node — a full-node compromise reachable from a single low-privileged account. A public PoC is reported to exist, and the Panel itself is not affected; the vulnerability is isolated to Wings.

What Defenders Should Do Now

• Upgrade Wings to v1.12.3 or later, where the templating engine no longer exposes the full daemon config — only a non-secret Docker network interface subset is resolvable via {{config.*}}.
• After upgrading, rotate affected nodes' daemon tokens, since a previously exfiltrated token remains valid until reset (Admin → Nodes → Configuration → reset token, then redeploy config.yml).
• If immediate upgrade isn't possible, audit eggs for user-editable variables rendered into configuration files (e.g. via {{server.build.env.*}}) and mark such variables non-editable as a partial mitigation.
• As a hunting angle, review server-side configuration files and SFTP/file-manager activity for unexpected occurrences of resolved {{config.*}} values or unusual daemon-token usage patterns across nodes.

This is developing, same-day intel based on the vendor's own disclosure; details may be refined as more information emerges. See the original advisory for full technical detail: GHSA-pfvc-3p5h-x7h6.