CVE-2026-54136
Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search
Description
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search. The route-level scope middleware validated the token domain and action but did not enforce the resource/path segment, and the list_search_scripts handler had no additional check_scopes call or per-row filtering before returning script path and content fields. A token such as scripts:read:f/allowed/* could therefore receive source code for unrelated paths in the same workspace, potentially disclosing internal automation logic, integration details, business logic, inline configuration, or hardcoded secrets and credentials. Exploitation required possession of a valid scoped API token for the workspace but did not require administrator privileges. This issue is fixed in version 1.715.0.
INFO
Published Date :
Aug. 20, 2026, 5:18 p.m.
Last Modified :
Oct. 18, 2026, 8:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 4.0 | MEDIUM | [email protected] |
Solution
- Update Windmill to version 1.715.0 or later.
- Review and restrict API token scopes.
- Audit accessible script contents.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-54136.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-54136 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-54136
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-54136 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-54136 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 18, 2026
Action Type Old Value New Value Added Translation Title: windmill de windmill-labs, Description: Windmill es una plataforma de desarrollo de código abierto para código interno: API, trabajos en segundo plano, flujos de trabajo e interfaces de usuario. Antes de la versión 1.715.0, un token de API con ámbito de recurso podía leer el contenido de los scripts fuera de su ámbito de ruta permitido a través de GET /api/w/{workspace}/scripts/list_search. El middleware de ámbito a nivel de ruta validaba el dominio y la acción del token, pero no aplicaba el segmento de recurso/ruta, y el gestor list_search_scripts no tenía ninguna llamada adicional a check_scopes ni filtrado por fila antes de devolver los campos de ruta y contenido del script. Un token como scripts:read:f/allowed/* podía, por lo tanto, recibir código fuente para rutas no relacionadas en el mismo espacio de trabajo, revelando potencialmente lógica de automatización interna, detalles de integración, lógica de negocio, configuración en línea o secretos y credenciales codificados. La explotación requería la posesión de un token de API con ámbito válido para el espacio de trabajo, pero no requería privilegios de administrador. Este problema está solucionado en la versión 1.715.0. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Aug. 21, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-54136', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-08-21T20:58:49.078615Z'} -
New CVE Received by [email protected]
Aug. 20, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'windmill-labs', 'product': 'windmill', 'versions': [{'status': 'affected', 'version': '< 1.715.0'}]}] Added Description Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search. The route-level scope middleware validated the token domain and action but did not enforce the resource/path segment, and the list_search_scripts handler had no additional check_scopes call or per-row filtering before returning script path and content fields. A token such as scripts:read:f/allowed/* could therefore receive source code for unrelated paths in the same workspace, potentially disclosing internal automation logic, integration details, business logic, inline configuration, or hardcoded secrets and credentials. Exploitation required possession of a valid scoped API token for the workspace but did not require administrator privileges. This issue is fixed in version 1.715.0. Added CVSS V4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Added CWE CWE-863 Added Reference https://github.com/windmill-labs/windmill/commit/7edf3f02122e20fde1e95e0252e7bda641075326 Added Reference https://github.com/windmill-labs/windmill/pull/9426 Added Reference https://github.com/windmill-labs/windmill/releases/tag/v1.715.0 Added Reference https://github.com/windmill-labs/windmill/security/advisories/GHSA-2ppx-66jv-wpw5