https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 05:57:12 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-52855 <p>Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.</p> <p>Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, {{config.}} placeholders in egg configuration-file templates allow a low-privileged user to read {{config.token}}, {{config.token_id}}, and {{config.docker.registries}} from the full daemon configuration. This issue is fixed in version 1.12.3.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-52855 https://vulnerability.circl.lu/vuln/ghsa-pfvc-3p5h-x7h6 <p><strong>Affected:</strong> Go: github.com/pterodactyl/wings</p> <p>### Impact</p> <p>**Type:** Exposure of sensitive information / insufficiently protected credentials leading to privilege escalation and full node compromise.</p> <p>Wings exposes its **entire** daemon configuration to the egg configuration-file templating engine. When Wings renders a server&#39;s configuration files, any `{{config.&lt;path&gt;}}` placeholder in a replacement value is resolved against the full marshalled daemon configuration, with no restriction on which paths may be read.</p> <p>Because the Panel substitutes **user-controlled** egg variable values into these replacements before sending them to Wings, a low-privileged user can smuggle a `{{config.*}}` placeholder through a variable value. The placeholder is then resolved by Wings and written into a file inside the user&#39;s own server, where it can be read via the file manager or SFTP.</p> <p>This allows reading, among other values:</p> <p>- `{{config.token}}` - the node&#39;s daemon token, which is both the API bearer for   the Panel⇆Wings channel **and** the HMAC signing key for every JWT the node   issues; - `{{config.token_id}}`; - `{{config.docker.registries}}` - configured container-registry credentials.</p> <p>**Who is impacted:** Any deployment where a user who is not fully trusted can set an egg variable value (e.g. a server owner or a subuser with the `startup.update` permission) **and** the server&#39;s egg renders a user-editable variable into a configuration file via `{{server.build.env.*}}`. This pattern is common across stock and community eggs, so…</p> <p><strong>Affected:</strong> Go: github.com/pterodactyl/wings</p> <p>### Impact</p> <p>**Type:** Exposure of sensitive information / insufficiently protected credentials leading to privilege escalation and full node compromise.</p> <p>Wings exposes its **entire** daemon configuration to the egg configuration-file templating engine. When Wings renders a server&#39;s configuration files, any `{{config.&lt;path&gt;}}` placeholder in a replacement value is resolved against the full marshalled daemon configuration, with no restriction on which paths may be read.</p> <p>Because the Panel substitutes **user-controlled** egg variable values into these replacements before sending them to Wings, a low-privileged user can smuggle a `{{config.*}}` placeholder through a variable value. The placeholder is then resolved by Wings and written into a file inside the user&#39;s own server, where it can be read via the file manager or SFTP.</p> <p>This allows reading, among other values:</p> <p>- `{{config.token}}` - the node&#39;s daemon token, which is both the API bearer for   the Panel⇆Wings channel **and** the HMAC signing key for every JWT the node   issues; - `{{config.token_id}}`; - `{{config.docker.registries}}` - configured container-registry credentials.</p> <p>**Who is impacted:** Any deployment where a user who is not fully trusted can set an egg variable value (e.g. a server owner or a subuser with the `startup.update` permission) **and** the server&#39;s egg renders a user-editable variable into a configuration file via `{{server.build.env.*}}`. This pattern is common across stock and community eggs, so…</p> https://vulnerability.circl.lu/vuln/ghsa-pfvc-3p5h-x7h6