CVE-2026-52855: Pterodactyl Wings Egg Templating Flaw Leaks Node Secrets (CVSS 9.9)

What's the vulnerability?

CVE-2026-52855 is a critical (CVSS 9.9) information disclosure flaw in the Pterodactyl Wings daemon, classified under CWE-200 (Exposure of Sensitive Information) and CWE-522 (Insufficiently Protected Credentials). The root cause is improper scoping in Wings' egg configuration-file templating engine: variable substitution is not restricted to server-level context, so a crafted egg or server configuration can reference node-level secrets — the Wings daemon token, SFTP credentials, and Docker/panel authentication secrets — and have them rendered directly into server-accessible configuration files.

The impact is severe. Any actor able to create or modify an egg can exfiltrate node-level secrets, which translates directly into full node takeover — control over the daemon, container runtime, and every server hosted on that node.

Who's affected

• Product: github.com/pterodactyl/wings (Go)
• Affected versions: all versions prior to 1.12.3

Exploitation vectors and status

Exploit status is public PoC. Realistic exploitation paths include:

• A compromised panel admin account creating or editing a malicious egg
• Supply-chain compromise via import of a malicious third-party egg
• A malicious server owner in a multi-tenant hosting environment abusing egg/config privileges

With a public PoC available, defenders should treat this as actively exploitable rather than theoretical, and prioritize patching to 1.12.3 or later alongside deploying detection.

How we detect it

This detection ships across Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL).

At a high level, the logic focuses on Wings daemon log telemetry, looking for:

• Configuration-file template rendering events that reference sensitive node-level configuration keys (daemon tokens, SFTP credentials, Docker/panel secrets)
• Unexpected or anomalous egg install/import activity, particularly from unfamiliar sources or outside normal change windows
• Access to rendered server configuration files that unexpectedly contain node-level secret values rather than server-scoped data

Correlating these signals lets defenders catch the exploitation attempt at the point of template rendering, rather than waiting to observe downstream node compromise.

Full detection details

For the complete detection logic, field mappings, and ready-to-deploy queries across all supported SIEM platforms, see the full detection page: CVE-2026-52855 on df00tech.