Originally published at HOL
CVE-2026-52855: Pterodactyl Wings Leaks Daemon Configuration Secrets via Egg Templates (CVSS 9.9)
TL;DR: Pterodactyl Wings, the Go daemon that powers game server nodes for the Pterodactyl panel, exposes its full daemon configuration to the egg template engine. Any {{config.<path>}} placeholder in an egg replacement value resolves against the complete marshalled config struct. Attackers who can influence egg templates can extract API keys, SFTP credentials, and database connection strings. CVSS 9.9. Fixed in Wings 1.12.3.
What is Pterodactyl Wings
Pterodactyl is a free, open-source game server management panel that has been the standard for self-hosted and commercial game hosting since 2015. The panel repository has 8,951 GitHub stars and 190 contributors. It runs each game server in an isolated Docker container, exposing a PHP and React web interface for management.
Wings is the daemon component. Written in Go, it installs on each game server node and handles server lifecycle, file management, SFTP, and resource allocation. The Wings repository has roughly 1,027 GitHub stars. At least 489 live websites run Pterodactyl Panel in production, and independent game hosting providers use it to manage fleets of 50 to 500+ servers per panel instance. Games running on Pterodactyl include Minecraft, Rust, Valheim, CS2, and ARK.
The daemon configuration file contains the API key Wings uses to communicate with the Panel, SFTP credentials, database connection strings, and system paths. These secrets are the keys to the entire node.
What happened
When Wings renders a server's configuration files, it processes {{config.<path>}} placeholders by resolving them against the full marshalled daemon configuration. There is no restriction on which paths may be read. The Panel substitutes egg variables into server configuration files, and any egg that includes a {{config.*}} reference in a replacement value triggers the leak.
The exposure is broad. The daemon configuration is a single struct, and every field is accessible through the templating engine. An attacker who can create or modify egg templates can read the daemon API key, SFTP credentials, database connection strings, and any other field in the config.
How big is the impact
If an attacker extracts the daemon API key, they can impersonate the node to the Panel. They can upload files, execute commands on the node, and potentially pivot to other nodes in the same Pterodactyl deployment. CVSS 9.9 reflects this: low attack complexity, no privileges required, high confidentiality and integrity impact.
For a commercial game host running 100+ servers across multiple Wings nodes, one compromised egg template exposes every node running that egg. The attacker gets the SFTP credentials for every server on that node, the database strings for any game databases, and the API key to talk to the Panel as that node. From there, lateral movement to other nodes in the same deployment is straightforward.
What to do
Update Wings to version 1.12.3 or later. The fix restricts which configuration paths the template engine can resolve.
# On each Wings node
wget https://github.com/pterodactyl/wings/releases/latest/download/wings_linux_amd64
chmod +x wings_linux_amd64
systemctl restart wings
After updating, audit your egg templates for any {{config.*}} references. If you found eggs that should not have had access to daemon config fields, rotate your daemon API keys and SFTP credentials.
