CVE-2026-23696

216.73.217.22

· Published 07/04/2026 17:16 · Modified 08/04/2026 21:27

Labels: CVE-2026-23696 2026-04-07 CVE-2026-23696 CWE-89 [email protected]

Essential information

Published: 07/04/2026 17:16
Modified: 08/04/2026 21:27
Author: —
Creator: —
CVSS: 9.4 CRITICAL (v3) 9.4 CRITICAL (v4.0)
CISA KEV: No
CWE: —
CVSS vector: —

CVSS metrics

Description

Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.

NVD status

Status: Awaiting Analysis — CVE has been recently published to the CVE List and has been received by the NVD.
Source: [email protected]
NVD: View on NVD

Affected products (CPE)

Product	CPE
windmill / windmill ce	`cpe:2.3:a:windmill:windmill_ce:1.276.0-1.603.2:::::::*`
windmill / windmill ee	`cpe:2.3:a:windmill:windmill_ee:1.276.0-1.603.2:::::::*`