CVE-2026-52855
CRITICAL · 9.9Real vuln, vendor patched immediately, but no weaponization signal; early advisory repetition dominates chatter.
What: Server-Side Template Injection (SSTI) in Wings (Pterodactyl game server management panel) prior to 1.12.3 allows low-privileged users to read daemon configuration secrets including API tokens and Docker registry credentials via {{config.}} placeholders in egg templates. CVSS 9.9 CRITICAL.
Why it matters: Published 31 July 2026; patch available same day (v1.12.3). High-severity credential exposure in widely-used open-source game hosting infrastructure. Social chatter reflects immediate awareness and urgent update guidance, but no public PoC or in-the-wild exploitation reported yet.
Where it's seen: Bluesky posts from security accounts repeating NVD advisory text and urging immediate patching. Posts in English and Japanese. No defender triage queries, no PoC repository mentions, no KEV listing observed.
RISK: CRITICAL — Unauthenticated token/credential leakage in production game server software; patch day-1 available.
Description
Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.
CVSS 3.1 breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H- Attack vector
- Network
- Complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Changed
- Confidentiality
- High
- Integrity
- High
- Availability
- High