Windmill Labs Windmill

• CVE-2026-54136 Medium 5.1 Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search 0.5%
• CVE-2026-72542 Medium 5.4 Windmill Labs Windmill - Missing Authorization 0.3%
• CVE-2026-72541 Medium 6.5 Windmill Labs Windmill - Missing Authorization 0.3%
• CVE-2026-72539 Medium 6.5 Windmill Labs Windmill - Information Disclosure 0.4%
• CVE-2026-47107 High 8.1 Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration 0.3%
• CVE-2026-33881 High 7.3 Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor 0.4%
• CVE-2026-29059 Medium 6.9 Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly 3.1%
• CVE-2026-26964 Low 2.7 Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members 0.3%