# CVE-2026-72542: Windmill Labs Windmill authorization bypass in job metrics

Source: https://junglewise.ai/threats/cve-2026-72542-windmill-labs-windmill-authorization-bypass-in-job-metrics  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-11. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-72542 · Severity: medium · CVSS 5.4 · Published 2026-08-11

Windmill is an open-source platform for creating and running workflows and automations. A missing authorization check allows authenticated operators to view job execution metrics and progress data for any job in their workspace, even jobs they don't own or have permission to access, and to inject false progress updates. This bypasses intended access controls and could expose sensitive job execution details across teams.

Technologies: [Windmill Labs Windmill](https://junglewise.ai/threats/technologies/windmill). Vendors: [Windmill Labs](https://junglewise.ai/threats/vendors/windmill-labs).

## Quick answers

**Is CVE-2026-72542 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-72542 being exploited in the wild.

**How severe is CVE-2026-72542?** Medium severity, with a CVSS score of 5.4, published 11 August 2026.

**Which products and versions are affected?** Windmill Labs Windmill through 1.783.0.

**Is there a fix for CVE-2026-72542?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-72542 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-72542?** Check whether you run Windmill Labs Windmill at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authorization check in the job_metrics API handlers in Windmill through version 1.783.0. The handlers accept no authorization extractor, allowing any authenticated operator to bypass workspace-level access controls and read job metrics or write job progress updates for jobs they do not own. An authenticated attacker can enumerate and monitor sensitive job execution data and inject misleading progress information, but requires valid authentication and operator-level privileges to exploit the flaw.

## Affected products

- Windmill Labs Windmill through 1.783.0

## Timeline

- 2026-08-11: disclosed

## References

- [https://github.com/windmill-labs/windmill](https://github.com/windmill-labs/windmill)

## Related threats

- [Windmill Labs Windmill authorization bypass in resource type update](https://junglewise.ai/threats/cve-2026-72541-windmill-labs-windmill-authorization-bypass-in-resource-type)
- [Windmill Labs Windmill information disclosure in draft scripts](https://junglewise.ai/threats/cve-2026-72539-windmill-labs-windmill-information-disclosure-in-draft-scripts)
- [Windmill incorrect default permissions in nsjail sandbox configuration](https://junglewise.ai/threats/cve-2026-47107-windmill-incorrect-default-permissions-in-nsjail-sandbox)