Description
An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace member who queries the drafts endpoint. Sensitive credentials stored in these drafts are exposed across ACL boundaries.
Published: 2026-08-11
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

An information disclosure flaw in Windmill Labs Windmill allows any authenticated workspace member to view legacy ownerless draft scripts that contain plaintext resource credentials. Because drafts with a null owner email bypass access control, these secrets are returned to anyone who queries the drafts endpoint, exposing sensitive data across ACL boundaries.

Affected Systems

Windmill Labs Windmill versions up to and including 1.783.0 are vulnerable. All releases prior to 1.783.0 also lack the fix and are potentially affected.

Risk and Exploitability

The vulnerability carries a CVSS score of 6.5, indicating a medium severity. An attacker only needs authenticated access within a workspace to exploit the flaw, and no special privileges are required. The issue is not listed in the CISA KEV catalog, suggesting a moderate likelihood of exploitation but still warrants prompt remediation.

Generated by OpenCVE AI on August 11, 2026 at 18:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Windmill to a version later than 1.783.0 that contains the fix.
  • Configure workspace settings to prevent creation of drafts without an owner or enforce strict ACL checks on such drafts.
  • Audit existing drafts for plaintext credentials and remove or encrypt them, then delete any that are no longer needed.
  • Limit or disable the drafts endpoint for users who do not require access to drafts data.

Generated by OpenCVE AI on August 11, 2026 at 18:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

References
Link Providers
https://github.com/windmill-labs/windmill cve-icon cve-icon
History

Tue, 11 Aug 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Windmill-labs
Windmill-labs windmill
Vendors & Products Windmill-labs
Windmill-labs windmill

Tue, 11 Aug 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 11 Aug 2026 11:30:00 +0000

Type Values Removed Values Added
Description An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace member who queries the drafts endpoint. Sensitive credentials stored in these drafts are exposed across ACL boundaries.
Title Windmill Labs Windmill - Information Disclosure
Weaknesses CWE-200
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Windmill-labs Windmill
cve-icon MITRE

Status: PUBLISHED

Assigner: TuranSec

Published:

Updated: 2026-08-11T12:37:03.236Z

Reserved: 2026-08-10T10:32:49.080Z

Link: CVE-2026-72539

cve-icon Vulnrichment

Updated: 2026-08-11T12:36:12.866Z

cve-icon NVD

Status : Received

Published: 2026-08-11T12:17:39.220

Modified: 2026-08-11T13:19:02.590

Link: CVE-2026-72539

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-11T18:15:07Z

Weaknesses
  • CWE-200

    Exposure of Sensitive Information to an Unauthorized Actor