Skip to content

Product

Windmill Labs Windmill vulnerabilities

3 published CVES affecting Windmill Labs Windmill, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
3
Critical
0
High
0
Medium
3
Low
0
Unscored
0
CISA KEV
0

Latest Windmill Labs Windmill CVEs

Newest publication first

  1. CVE-2026-72542 Windmill Labs Windmill - Missing Authorization

    Published
    MediumCVSS 5.4 EPSS 0.30%

    A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept no authorization extractor, bypassing wo...

  2. CVE-2026-72541 Windmill Labs Windmill - Missing Authorization

    Published
    MediumCVSS 6.5 EPSS 0.30%

    A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to overwrite any resource type schema via the update_resource_type endpoint. The endpoint omits the administrator permission check that the corresponding dele...

  3. CVE-2026-72539 Windmill Labs Windmill - Information Disclosure

    Published
    MediumCVSS 6.5 EPSS 0.40%

    An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned t...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.