Log in Start free

Windmill Labs

Products

ProductCVEsExploitedLatest
Windmill8–Aug 20, 2026
Windmill CE (Community Edition)2–Apr 7, 2026
Windmill EE (Enterprise Edition)2–Apr 7, 2026

Exploited and recent CVEs

  • CVE-2026-54136 Medium 5.1 Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search 0.5%
  • CVE-2026-72542 Medium 5.4 Windmill Labs Windmill - Missing Authorization 0.3%
  • CVE-2026-72541 Medium 6.5 Windmill Labs Windmill - Missing Authorization 0.3%
  • CVE-2026-72539 Medium 6.5 Windmill Labs Windmill - Information Disclosure 0.4%
  • CVE-2026-47107 High 8.1 Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration 0.3%
  • CVE-2026-23696 Critical 9.9 Windmill < 1.603.3 File Ownership Handling SQLi RCE 13.6%
  • CVE-2026-23696 Critical 9.9 Windmill < 1.603.3 File Ownership Handling SQLi RCE 13.6%
  • CVE-2026-22683 High 8.8 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE 2.6%
  • CVE-2026-22683 High 8.8 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE 2.6%
  • CVE-2026-33881 High 7.3 Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor 0.4%
  • CVE-2026-29059 Medium 6.9 Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly 3.1%
  • CVE-2026-26964 Low 2.7 Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members 0.3%