# Wings exposes node configuration secrets through egg configuration-file templating

Wings resolves user-smuggled {{config.*}} placeholders in egg templating against its full daemon config, leaking the node token and registry credentials.

- Payout: Research
- Severity: critical
- Program: Pterodactyl Wings
- Found by: robertdrakedennis
- Disclosed: 2026-07-31
- CVE: CVE-2026-52855
- Write-up quality: 7/10
- Original: https://github.com/advisories/GHSA-pfvc-3p5h-x7h6
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-pfvc-3p5h-x7h6
- Tags: area:cloud domain:infra impact:internal-access impact:privesc kind:research platform:ghsa sev:critical tech:go technique:second-order vuln:auth-bypass vuln:info-disclosure vuln:privilege-escalation vuln:secrets-leak

**Target:** Wings daemon config-file templating engine (egg variables)
**Root cause:** Wings exposes its entire marshalled daemon configuration to the {{config.<path>}} templating resolver with no path allowlist, and the Panel substitutes user-controlled egg variable values into replacements before sending them to Wings.
**Steps:**
1. Identify an egg that renders a user-editable variable into a config file via `{{server.build.env.*}}`.
2. As a user with startup.update, set that variable's value to `{{config.token}}` (or `{{config.docker.registries}}`).
3. Panel substitutes the value into the replacement and sends it to Wings.
4. Wings resolves `{{config.token}}` against the full daemon config and writes the secret into a file in the user's server.
5. Read the file via the file manager or SFTP to obtain the node daemon token.
**Exploitation:** Low-privileged user smuggles a {{config.*}} placeholder through an egg variable; Wings writes the resolved secret into a server file readable via file manager/SFTP. The leaked daemon token is both the Panel⇆Wings API bearer and the HMAC signing key for node JWTs, enabling forged tokens against every server on the node.
**Escalation:** Leaked daemon token allows forging authentication tokens and acting against every server on the node — full-node compromise from a low-privileged account.
**Insight:** When a templating engine resolves placeholders against a whole config object, check whether user-controlled values can themselves contain placeholders (second-order template injection) — the substitution boundary between Panel and Wings is where the trust breaks.