Executive brief
Windmill is an open-source developer platform used to create workflows and automate infrastructure scripts. A vulnerability allows any authenticated member of a workspace to access draft scripts that lack an owner, exposing plaintext database credentials and API keys stored within them. An attacker with workspace access can read sensitive credentials meant to be protected, potentially leading to unauthorized access to upstream systems and data theft.
Technical details
An information disclosure vulnerability exists in the draft scripts endpoint due to improper access control list (ACL) enforcement. Draft scripts with a null owner email bypass ACL checks and are returned to any authenticated workspace member querying the drafts endpoint. The vulnerability stems from inadequate validation of ownership before returning draft objects containing plaintext resource credentials. Attack requires valid workspace authentication but no additional privilege escalation. An attacker can enumerate and read all ownerless drafts, extracting credentials for databases, APIs, and other integrated resources. The issue is tracked as CVE-2026-72539 and affects Windmill through version 1.783.0.
Affected products
- Windmill Labs Windmill through 1.783.0
Timeline
- 2026-08-11: disclosed