CVE-2026-52855

CriticalCVSS 9.9/10Last modified Oct 23, 2026

Description

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.

Metrics

CVSS 3.1 9.9/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-200 CWE-522

Affected software

No affected versions have been published.

Timeline

Published: Jul 31, 2026
Last modified: Oct 23, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-528567.5Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet rec CVE-2026-528575.5Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, CVE-2026-528587.8Vim is an open source, command line text editor. Prior to version 9.2.0561, the Python omni-completion script in python3complete.vim for Vim CVE-2026-528598.2Vim is an open source, command line text editor. Prior to version 9.2.0565, the update_snapshot() function in src/terminal.c copies the visi CVE-2026-52868.8Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page.CVE-2026-528607.8Vim is an open source, command line text editor. Prior to version 9.2.0597, Vim's Python omni-completion executes reconstructed function and CVE-2026-528635.9In NLnet Labs Unbound 1.25.0 up to and including 1.25.1, a fix that makes the 'respip' and 'dns64' modules work together, creates a shallow CVE-2026-528656.5When NGINX Ingress Controller processes Ingress or TransportServer resources, an authenticated, remote attacker with permission to create or CVE-2026-528666.5An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or CVE-2026-528688.2An unauthenticated attacker can read worklist records from a directory outside the intended per-AE worklist storage area. In a multi-area de CVE-2026-528697.1The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.27.2, the SSE and statefu CVE-2026-52878.8Use after free in PDF in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to execute arbitrary code inside a sandbox via a cr