CVE-2026-52855

Name of the Vulnerable Software and Affected Versions Wings versions prior to 1.12.3

Description Wings exposes its entire daemon configuration to the egg configuration-file templating engine. When rendering configuration files, any {{config.<path>}} placeholder in a replacement value is resolved against the full daemon configuration without restrictions. Since the Panel substitutes user-controlled egg variable values into these replacements, a low-privileged user can insert a {{config.*}} placeholder. This allows the user to read sensitive information written into a file within their own server via the file manager or SFTP, including {{config.token}} (the node's daemon token used as an API bearer and HMAC signing key), {{config.token id}}, and {{config.docker.registries}} (container-registry credentials). This exposure can lead to privilege escalation and full node compromise, allowing an attacker to forge authentication tokens and act against every server on that node.

Recommendations Update Wings to version 1.12.3 or later. After updating, rotate the daemon tokens for the affected nodes by resetting the token in the Admin panel and re-deploying the config.yml file to the node. As a temporary workaround, audit eggs to ensure no user-editable variable is rendered into a configuration file or mark such variables as non-editable.