CVE-2026-52856: SFTP handshake DoS via Go panic

CISO Take

Wings, the daemon that controls game server containers for the Pterodactyl panel, crashes with an unhandled Go panic when it receives a malformed packet during the SFTP connection handshake, before authentication even completes. Any unauthenticated attacker with network access to the SFTP port can trigger this over the network with low complexity and no user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), taking down the entire Wings node and every server it manages. There is no EPSS score, CISA KEV listing, public exploit, or Nuclei template currently associated with this CVE, so exploitation pressure appears low today, but the trigger condition is trivial to reproduce once the flaw is understood. Note this is not an AI/ML-specific vulnerability — Wings is a general-purpose game server control plane, and its appearance here under the ml_ui category looks like a classification artifact rather than a genuine AI/ML finding, unless it happens to be used to host AI-related workloads in your environment. Action: upgrade Wings to 1.13.0 or later, per the vendor advisory and commit 8e49c7c.

Sources: NVD GitHub Advisory

What is the risk?

Technically trivial to exploit: network-reachable, low attack complexity, no privileges or user interaction required, and the crash occurs during the pre-authentication SFTP handshake. Impact is limited to availability (C:N/I:N/A:H) — a full denial of service for the Wings daemon and all game server containers it manages, but no confidentiality or integrity compromise. No EPSS score, no CISA KEV listing, no public exploit code, and no Nuclei template were found, indicating no confirmed active exploitation or mass-scanning activity at this time — but the low complexity means that could change quickly once a PoC packet structure is published.

How does the attack unfold?

Entry point

Attacker establishes an unauthenticated network connection to the Wings daemon's SFTP port.

Trigger

Attacker sends a malformed packet during the SFTP handshake, before any authentication completes.

Impact

The malformed packet causes an unhandled Go panic, crashing the Wings daemon and taking all managed game server containers on that node offline.

Entry point

Attacker establishes an unauthenticated network connection to the Wings daemon's SFTP port.

Trigger

Attacker sends a malformed packet during the SFTP handshake, before any authentication completes.

Impact

The malformed packet causes an unhandled Go panic, crashing the Wings daemon and taking all managed game server containers on that node offline.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AV Network

AC Low

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

Upgrade Wings to version 1.13.0 or later immediately — the fix is already released (see commit 8e49c7c and GHSA-ghrq-5wpp-hxx5). If immediate patching isn't possible, restrict network access to the Wings SFTP port to trusted/VPN-only sources as a compensating control. Detection: monitor for unexpected Wings daemon crashes/restarts in logs, especially correlated with SFTP connection attempts from unrecognized source IPs, and alert on repeated daemon restarts as a potential DoS indicator.

How is it classified?

DoS Framework

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2026-52856?

Wings, the daemon that controls game server containers for the Pterodactyl panel, crashes with an unhandled Go panic when it receives a malformed packet during the SFTP connection handshake, before authentication even completes. Any unauthenticated attacker with network access to the SFTP port can trigger this over the network with low complexity and no user interaction (CVSS 7.5, AV:N/AC:L/PR:N/UI:N), taking down the entire Wings node and every server it manages. There is no EPSS score, CISA KEV listing, public exploit, or Nuclei template currently associated with this CVE, so exploitation pressure appears low today, but the trigger condition is trivial to reproduce once the flaw is understood. Note this is not an AI/ML-specific vulnerability — Wings is a general-purpose game server control plane, and its appearance here under the ml_ui category looks like a classification artifact rather than a genuine AI/ML finding, unless it happens to be used to host AI-related workloads in your environment. Action: upgrade Wings to 1.13.0 or later, per the vendor advisory and commit 8e49c7c.

Is CVE-2026-52856 actively exploited?

No confirmed active exploitation of CVE-2026-52856 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-52856?

Upgrade Wings to version 1.13.0 or later immediately — the fix is already released (see commit 8e49c7c and GHSA-ghrq-5wpp-hxx5). If immediate patching isn't possible, restrict network access to the Wings SFTP port to trusted/VPN-only sources as a compensating control. Detection: monitor for unexpected Wings daemon crashes/restarts in logs, especially correlated with SFTP connection attempts from unrecognized source IPs, and alert on repeated daemon restarts as a potential DoS indicator.

What is the CVSS score for CVE-2026-52856?

CVE-2026-52856 has a CVSS v3.1 base score of 7.5 (HIGH).

What are the technical details?

Original Advisory

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0.

Exploitation Scenario

An attacker with network reachability to a Pterodactyl Wings node's SFTP port sends a single malformed packet during the connection handshake, before any authentication is required. The malformed input triggers an unhandled panic in the Go runtime, crashing the Wings daemon and taking every game server container on that node offline until the process is restarted — a low-effort, repeatable denial-of-service attack against hosting infrastructure.

Weaknesses (CWE)

CWE-129 Improper Validation of Array Index Primary CWE-248 Uncaught Exception Primary CWE-617 Reachable Assertion Primary CWE-755 Improper Handling of Exceptional Conditions Primary CWE-129 Improper Validation of Array Index CWE-248 Uncaught Exception CWE-617 Reachable Assertion CWE-755 Improper Handling of Exceptional Conditions

CWE-129 — Improper Validation of Array Index: The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.

[Architecture and Design] Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server. Even though client-side checks provide minimal benefits with respect to server-side security, they are still useful. First, they can support intrusion detection. If the server receives input that should have been rejected by the client, then it may be an indication of an attack. Second, client-side error-checking can provide helpful feedback to the user about the expectations for valid input. Third, there may be a reduction in server-side processing time for accidental input errors, although this is typically a small savings.

Source: MITRE CWE corpus.