Pterodactyl Wings CVE-2026-52855

Requires an authenticated low-privileged panel account that can set an egg variable value - a server owner, or a subuser with the startup.update permission (PR:L). The decisive limiting precondition is that the server's egg must render a user-editable variable into a configuration file via a {{server.build.env.*}} substitution; if no user-editable variable is written into a config file (or such variables are marked non-editable), the placeholder is never resolved and the attack fails. The attacker must then be able to read the rendered file, i.e. have file-manager or SFTP access to their own server. No admin/end-user interaction is needed and exploitation is network-reachable. This egg pattern is common across stock and community eggs, so most multi-tenant / shared-hosting Wings deployments before v1.12.3 meet the condition, while single-tenant or fully-trusted deployments generally do not present a meaningful trust boundary to cross.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, 9.9) reflects a genuinely severe outcome: network-reachable, low-complexity, only low privileges (a normal server owner) needed, no user interaction, and a scope change because disclosure of the daemon token cascades into control of every server on the node. Two signals temper raw urgency: it is not in CISA KEV (no confirmed active exploitation) and no POC is referenced, so treat this as high-priority-but-not-yet-exploited. One important caveat: the base vector marks AC:L, but exploitation also requires that the target server's egg actually render a user-editable variable into a configuration file - a real precondition the vector does not capture (arguably AC:H or an attack requirement). No EPSS score or SSVC decision data was provided and none can be cited. Net: for multi-tenant / shared game-hosting operators this is a top-priority patch because the direct impact is full-node compromise from a cheap account; for single-tenant or fully-trusted deployments the practical risk is materially lower.

A customer on a shared game-hosting node who owns a single low-tier server (or a subuser granted startup.update) edits an egg variable that the egg renders into a server config file, setting its value to include {{config.token}}. Wings resolves the placeholder against its full daemon configuration and writes the node's daemon token into the file, which the attacker reads back over SFTP or the panel file manager; they then use that token to forge JWTs and issue privileged Wings API calls against every other server on the node. No POC is publicly referenced, but the attack requires only a normal account and low complexity.