crates.io windmill-api vulnerabilities

Latest crates.io windmill-api CVEs

Newest publication first

1. CVE-2026-54136 Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

   Published 2026-08-20

   Medium·CVSS 5.1 EPSS 0.47%

   Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search. The route-level s...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.