CVE Feed

    Dashboard / CVE / CVE-2026-72542

    CVE-2026-72542

    A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept no authorization extractor, bypassing workspace-level access controls. An operator can monitor sensitive job execution data and inject misleading progress for jobs they do not own.

    Published:Aug 11, 2026
    Last Modified:Aug 11, 2026
    EPS:Aug 11, 2026
    EPSS Score:
    CVSS Score:5.4

    Affected Products

    Vendor
    Windmill-labs
    Product
    Windmill

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-54136 (CVSS 5.1) — Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Pri…
    CVE-2026-72541 (CVSS 6.5) — A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated works…
    CVE-2026-72539 (CVSS 6.5) — An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated wor…
    CVE-2026-47107 (CVSS 8.6) — Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configurat…
    CVE-2026-22683 (CVSS 8.7) — Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with …
    CVE-2026-33881 (CVSS 7.3) — Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Wor…
    CVE-2026-29059 (CVSS 6.9) — Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Pri…
    CVE-2026-26964 (CVSS 2.7) — Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Ver…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High