windmill-labs windmill vulnerabilities
5 published CVEs name windmill-labs windmill among the affected products.
- 5Published CVEs5 of them scored
- 5Last 12 monthspublished in the last year
- 0Critical2 more rated high
- 0Known exploitedin CISA's KEV catalog
Newest CVEs
- CVE-2026-54136
Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search
windmill-labs · windmill
Medium5.1 - CVE-2026-47107
Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration
windmill-labs · windmill
High8.6 - CVE-2026-33881
Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor
windmill-labs · windmill
High7.3 - CVE-2026-29059
Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly
windmill-labs · windmill
Medium6.9 - CVE-2026-26964
Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members
windmill-labs · windmill
Low2.7