Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-26964— Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members

Quick assessment

Affected
windmill-labs windmill
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WindMill是Lukasavicus个人开发者的一个免费的开源工具。用于控制 Python 中的作业执行。 WindMill 1.634.6及之前版本存在信息泄露漏洞，该漏洞源于非管理员用户可获取Slack OAuth客户端密钥，可能导致敏感信息泄露。

CVSS 2.7 · Low EPSS 0.42% · P35

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-26964

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members
Source: CVE Program / CVE List V5
Vulnerability Description
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET /api/w/{workspace}/workspaces/get_settings endpoint returns the slack_oauth_client_secret to any authenticated workspace member, regardless of their admin status. It is expected behavior for non-admin users see a redacted version of workspace settings, as some of them are necessary for the frontend to behave correctly even for non-admins. However, the Slack configuration should not be visible to non-admins. This is a legacy issue where the setting was stored as a plain value instead of using $variable indirection, and it was never added to the redaction logic. This issue has been fixed in version 1.635.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
信息暴露
Source: CVE Program / CVE List V5
Vulnerability Title
WindMill 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WindMill是Lukasavicus个人开发者的一个免费的开源工具。用于控制 Python 中的作业执行。 WindMill 1.634.6及之前版本存在信息泄露漏洞，该漏洞源于非管理员用户可获取Slack OAuth客户端密钥，可能导致敏感信息泄露。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
windmill-labs windmill < 1.635.0 -

II. Public POCs for CVE-2026-26964

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-26964

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-26964 (1)

IV. Related Vulnerabilities

Same product: windmill
Same vendor: windmill-labs
Same weakness: CWE-200

V. Comments for CVE-2026-26964

No comments yet

Leave a comment