Skip to content
OpenAdvisories

Vendor

windmill-labs

10 known vulnerabilities.

Products

windmill 8 Windmill CE (Community Edition) 2 Windmill EE (Enterprise Edition) 2
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.1
    CVE-2026-47107

    Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration

    Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions, allowing authenticated users to write arbitrary entries to /etc/hosts, /etc/res…

    windmill-labs windmill
  • High 8.8
    CVE-2026-22683 Scanner template

    Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

    Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as…

    windmill-labs Windmill EE (Enterprise Edition) Windmill CE (Community Edition)
  • High 7.3
    CVE-2026-33881

    Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor

    Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Workspace environment variable values are interpolated into JavaScript string literals without escaping single quotes in the NativeTS executor. A worksp…

    windmill-labs windmill