Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-54136— Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search

Quick assessment

Affected
windmill-labs windmill
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Windmill Labs Windmill是Windmill Labs组织的一个将脚本转化为工作流和内部应用的自动化平台。 Windmill Labs Windmill 1.715.0之前版本存在授权问题漏洞，该漏洞源于对资源作用域API令牌的路径范围验证不当，导致通过GET /api/w/{workspace}/scripts/list_search读取允许路径之外的脚本内容，可能泄露内部自动化逻辑、集成细节、业务逻辑、内联配置或硬编码密钥和凭据。

CVSS 5.1 · Medium EPSS 0.47% · P39

Possible ATT&CK Techniques 1 AI

T1530 · Data from Cloud Storage

Affected Version Matrix 1

VendorProduct Version RangeStatus
windmill-labs windmill < 1.715.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-54136

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search
Source: CVE Program / CVE List V5
Vulnerability Description
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search. The route-level scope middleware validated the token domain and action but did not enforce the resource/path segment, and the list_search_scripts handler had no additional check_scopes call or per-row filtering before returning script path and content fields. A token such as scripts:read:f/allowed/* could therefore receive source code for unrelated paths in the same workspace, potentially disclosing internal automation logic, integration details, business logic, inline configuration, or hardcoded secrets and credentials. Exploitation required possession of a valid scoped API token for the workspace but did not require administrator privileges. This issue is fixed in version 1.715.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Windmill Labs Windmill 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Windmill Labs Windmill是Windmill Labs组织的一个将脚本转化为工作流和内部应用的自动化平台。 Windmill Labs Windmill 1.715.0之前版本存在授权问题漏洞，该漏洞源于对资源作用域API令牌的路径范围验证不当，导致通过GET /api/w/{workspace}/scripts/list_search读取允许路径之外的脚本内容，可能泄露内部自动化逻辑、集成细节、业务逻辑、内联配置或硬编码密钥和凭据。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
windmill-labs windmill < 1.715.0 -

II. Public POCs for CVE-2026-54136

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-54136

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-54136 (2)

Vendor Advisories for CVE-2026-54136 (1)

Vendor Pages for CVE-2026-54136 (1)

IV. Related Vulnerabilities

Same product: windmill
Same vendor: windmill-labs
Same weakness: CWE-863

V. Comments for CVE-2026-54136

No comments yet

Leave a comment