A flaw in Wings, the server control plane for Pterodactyl, allows a low‑privileged user to read sensitive configuration values such as the daemon token, token ID, and Docker registry information by inserting {{config.}} placeholders into egg configuration templates. This results in a serious breach of confidentiality, exposing credentials that could compromise the entire server setup. The weakness is classified as CWE‑200 (Information Exposure) and CWE‑522 (Insufficiently Protected Credentials).

The affected product is Pterodactyl Wings. Versions earlier than 1.12.3 are vulnerable, as the issue was fixed in that release. Users with local or low‑privileged access to the egg configuration templates are potentially impacted.

The CVSS score of 9.9 indicates critical severity, yet the EPSS score of less than 1% suggests that active exploitation is currently unlikely. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector involves a local user who can edit egg templates, then triggering the templating engine to read the full daemon configuration. No external network access is required, making this a local exploitation scenario with no prerequisite for remote code execution.