PT-2026-66782 · Wings · Wings
CVE-2026-52855
·
Published
2026-07-31
·
Updated
2026-07-31
CVSS v3.1
9.9
Critical
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Wings versions prior to 1.12.3
Description
Wings exposes its entire daemon configuration to the egg configuration-file templating engine. When rendering configuration files, any
{{config.<path>}} placeholder in a replacement value is resolved against the full daemon configuration without restrictions. Since the Panel substitutes user-controlled egg variable values into these replacements, a low-privileged user can insert a {{config.*}} placeholder. This allows the user to read sensitive information written into a file within their own server via the file manager or SFTP, including {{config.token}} (the node's daemon token used as an API bearer and HMAC signing key), {{config.token id}}, and {{config.docker.registries}} (container-registry credentials). This exposure can lead to privilege escalation and full node compromise, allowing an attacker to forge authentication tokens and act against every server on that node.Recommendations
Update Wings to version 1.12.3 or later.
After updating, rotate the daemon tokens for the affected nodes by resetting the token in the Admin panel and re-deploying the
config.yml file to the node.
As a temporary workaround, audit eggs to ensure no user-editable variable is rendered into a configuration file or mark such variables as non-editable.Fix
Insufficiently Protected Credentials
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Wings