Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configurat…

CVE-2026-52855 affects Wings, the server control plane for Pterodactyl, an open-source game server management panel. Prior to version 1.12.3, template placeholders in egg configuration-file templates ({{config.}}) could be exploited by low-privileged users to read sensitive daemon configuration values including config.token, config.token_id, and config.docker.registries. This represents an unauthorized information disclosure vulnerability that could expose authentication tokens and Docker registry credentials. The flaw exists in how the template engine processes configuration placeholders without proper access controls. A patch has been issued in version 1.12.3 of Wings. Users are strongly advised to upgrade immediately to prevent credential exposure. The fix is documented in the official GitHub commit and security advisory.