CVE-2026-52855: Panel egg template leaks daemon

Q: Is CVE-2026-52855 actively exploited?

No confirmed active exploitation of CVE-2026-52855 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-52855?

1) Upgrade Wings to 1.12.3 or later immediately — this fully remediates the placeholder-resolution flaw. 2) Rotate the daemon API token/token ID and any Docker registry credentials stored in the daemon configuration, since they may already be compromised if untrusted users had egg-editing access prior to patching. 3) Audit egg configuration templates for any recent or unusual {{config.}} placeholder usage by non-admin accounts. 4) Review daemon and panel audit logs for evidence of low-privileged users creating/editing servers or eggs referencing config.token, config.token_id, or config.docker.registries. 5) Restrict egg-creation/edit permissions to trusted administrators as defense in depth, independent of the patch.

Q: What systems are affected by CVE-2026-52855?

This vulnerability affects the following AI/ML architecture patterns: model serving, agent frameworks.

Q: What is the CVSS score for CVE-2026-52855?

CVE-2026-52855 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.29%.

CISO Take

Wings, the game-server control-plane daemon behind the Pterodactyl panel, lets any low-privileged user read the full daemon configuration — including the API token, token ID, and Docker registry credentials — by abusing {{config.}} placeholders in egg configuration templates. The CVSS 9.9 score reflects total compromise potential: whoever holds the daemon token controls every container the daemon manages, and stolen registry credentials extend that access into the image supply chain. There is no public exploit, no Nuclei template, no EPSS score, and it is not in CISA KEV, so this looks like a disclosure-driven fix rather than a vulnerability under active exploitation — but the low complexity (no user interaction, low privilege required, network vector) means a working exploit is trivial to reproduce once the diff is public. This is worth flagging on our platform only if the org uses Wings/Pterodactyl to host AI/ML workloads (e.g., containerized inference services or model-serving images pulled from the exposed registries) — the CVE itself is a general infrastructure control-plane flaw, not an AI-specific attack technique. Action: upgrade Wings to 1.12.3 immediately, rotate the daemon API token and any exposed Docker registry credentials, and audit egg templates plus daemon logs for anomalous {{config.}} references from non-admin accounts.

Sources: NVD GitHub Advisory

What is the risk?

Critical on paper (CVSS 9.9, AV:N/AC:L/PR:L/UI:N, full C/I/A impact) because a low-privileged, authenticated user can escalate to full daemon control with no user interaction and low attack complexity. However, real-world exploitation likelihood is currently unconfirmed: no EPSS score, no public PoC, no scanner template, and not listed in CISA KEV. Exposure is limited to organizations actually running self-hosted Wings instances with multi-tenant, low-privileged user access (typical of shared game/app hosting providers) — it is not internet-wide by default since it requires an authenticated account capable of editing/using egg templates.

How does the attack unfold?

Initial Access

A low-privileged, authenticated Pterodactyl user creates or edits an egg configuration template referencing {{config.token}}, {{config.token_id}}, or {{config.docker.registries}} placeholders.

Config Disclosure

Wings renders the egg against the full daemon configuration rather than a server-scoped subset, exposing the daemon API token, token ID, and Docker registry credentials to the low-privileged user.

Credential Harvesting

The attacker collects the disclosed daemon API token and registry credentials from the rendered egg output or logs.

AML.T0055

Impact

Using the stolen daemon token, the attacker gains full control of every container the Wings daemon manages, and uses the registry credentials to pull or tamper with container images, including any AI/ML workloads hosted on the node.

Initial Access

A low-privileged, authenticated Pterodactyl user creates or edits an egg configuration template referencing {{config.token}}, {{config.token_id}}, or {{config.docker.registries}} placeholders.

Config Disclosure

Wings renders the egg against the full daemon configuration rather than a server-scoped subset, exposing the daemon API token, token ID, and Docker registry credentials to the low-privileged user.

Credential Harvesting

The attacker collects the disclosed daemon API token and registry credentials from the rendered egg output or logs.

AML.T0055

Impact

Using the stolen daemon token, the attacker gains full control of every container the Wings daemon manages, and uses the registry credentials to pull or tamper with container images, including any AI/ML workloads hosted on the node.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Panel	go	< 1.12.3	`1.12.3`
5.8K OpenSSF 6.7 507 dependents Pushed 8d ago 69% patched ~13d to patch Full package profile →

Do you use Panel? You're affected.

How severe is it?

CVSS 3.1

9.9 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 22% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C High

I High

A High

What should I do?

1 step

1) Upgrade Wings to 1.12.3 or later immediately — this fully remediates the placeholder-resolution flaw. 2) Rotate the daemon API token/token ID and any Docker registry credentials stored in the daemon configuration, since they may already be compromised if untrusted users had egg-editing access prior to patching. 3) Audit egg configuration templates for any recent or unusual {{config.}} placeholder usage by non-admin accounts. 4) Review daemon and panel audit logs for evidence of low-privileged users creating/editing servers or eggs referencing config.token, config.token_id, or config.docker.registries. 5) Restrict egg-creation/edit permissions to trusted administrators as defense in depth, independent of the patch.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Auth Bypass Plugin AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

GOVERN-6.1 - Policies and procedures are in place to address third-party/supply-chain risks

Frequently Asked Questions

What is CVE-2026-52855?

Wings, the game-server control-plane daemon behind the Pterodactyl panel, lets any low-privileged user read the full daemon configuration — including the API token, token ID, and Docker registry credentials — by abusing {{config.}} placeholders in egg configuration templates. The CVSS 9.9 score reflects total compromise potential: whoever holds the daemon token controls every container the daemon manages, and stolen registry credentials extend that access into the image supply chain. There is no public exploit, no Nuclei template, no EPSS score, and it is not in CISA KEV, so this looks like a disclosure-driven fix rather than a vulnerability under active exploitation — but the low complexity (no user interaction, low privilege required, network vector) means a working exploit is trivial to reproduce once the diff is public. This is worth flagging on our platform only if the org uses Wings/Pterodactyl to host AI/ML workloads (e.g., containerized inference services or model-serving images pulled from the exposed registries) — the CVE itself is a general infrastructure control-plane flaw, not an AI-specific attack technique. Action: upgrade Wings to 1.12.3 immediately, rotate the daemon API token and any exposed Docker registry credentials, and audit egg templates plus daemon logs for anomalous {{config.}} references from non-admin accounts.

Is CVE-2026-52855 actively exploited?

No confirmed active exploitation of CVE-2026-52855 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-52855?

1) Upgrade Wings to 1.12.3 or later immediately — this fully remediates the placeholder-resolution flaw. 2) Rotate the daemon API token/token ID and any Docker registry credentials stored in the daemon configuration, since they may already be compromised if untrusted users had egg-editing access prior to patching. 3) Audit egg configuration templates for any recent or unusual {{config.}} placeholder usage by non-admin accounts. 4) Review daemon and panel audit logs for evidence of low-privileged users creating/editing servers or eggs referencing config.token, config.token_id, or config.docker.registries. 5) Restrict egg-creation/edit permissions to trusted administrators as defense in depth, independent of the patch.

What systems are affected by CVE-2026-52855?

This vulnerability affects the following AI/ML architecture patterns: model serving, agent frameworks.

What is the CVSS score for CVE-2026-52855?

CVE-2026-52855 has a CVSS v3.1 base score of 9.9 (CRITICAL). The EPSS exploitation probability is 0.29%.

What is the AI security impact?

Affected AI Architectures

model servingagent frameworks

MITRE ATLAS Techniques

AML.T0055 Unsecured Credentials

Compliance Controls Affected

NIST AI RMF: GOVERN-6.1

What are the technical details?

Original Advisory

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.

Exploitation Scenario

A low-privileged Pterodactyl user (e.g., a customer with access to create or configure a server, but no admin rights) crafts or edits an egg configuration template to include {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} placeholders. When Wings renders the egg for that user's server, it resolves these placeholders against the full daemon configuration instead of restricting them to server-scoped values, surfacing the daemon's privileged API token, its identifier, and Docker registry credentials in the rendered output (e.g., startup variables or logs visible to the user). The attacker then uses the stolen daemon API token to authenticate directly against the Wings daemon API with full privileges — controlling, inspecting, or destroying every container on that node — and uses the harvested registry credentials to pull or push images in the organization's container registry, potentially poisoning images later deployed to other tenants or workloads.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-522 Insufficiently Protected Credentials Primary CWE-522 Insufficiently Protected Credentials Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-522 Insufficiently Protected Credentials

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.