Windmill Labs Windmill
8 CVEs affecting Windmill Labs Windmill. Latest disclosed: 2026-08-20. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47107 | High | 8.1 | 2026-05-19 | Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read… |
CVE-2026-29059 | High | 7.5 | 2026-03-06 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path tr… |
CVE-2026-33881 | High | 7.2 | 2026-03-27 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolat… |
CVE-2026-72541 | Medium | 6.5 | 2026-08-11 | A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema… |
CVE-2026-72539 | Medium | 6.5 | 2026-08-11 | An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scri… |
CVE-2026-72542 | Medium | 5.4 | 2026-08-11 | A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for a… |
CVE-2026-26964 | Low | 2.7 | 2026-02-20 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to… |
CVE-2026-54136 | | 2026-08-20 | Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could… |