CVE-2026-72542— Windmill Labs Windmill - Missing Authorization
Quick assessment
Affected
Windmill Labs Windmill
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Windmill Labs Windmill是Windmill Labs组织的一款可构建内部工具与自动化工作流的软件平台。 Windmill Labs Windmill 1.783.0及之前版本存在授权问题漏洞，该漏洞源于缺少授权验证，可能导致已认证操作者绕过工作区级访问控制，读取任意作业的敏感执行数据并注入误导性进度。
Possible ATT&CK Techniques 2 AI
T1565.001 · Stored Data Manipulation T1530 · Data from Cloud StorageAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Windmill Labs | Windmill | ≤ 1.783.0 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-72542
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Windmill Labs Windmill - Missing Authorization
Source: CVE Program / CVE List V5
Vulnerability Description
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept no authorization extractor, bypassing workspace-level access controls. An operator can monitor sensitive job execution data and inject misleading progress for jobs they do not own.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
关键功能的认证机制缺失
Source: CVE Program / CVE List V5
Vulnerability Title
Windmill Labs Windmill 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Windmill Labs Windmill是Windmill Labs组织的一款可构建内部工具与自动化工作流的软件平台。 Windmill Labs Windmill 1.783.0及之前版本存在授权问题漏洞，该漏洞源于缺少授权验证，可能导致已认证操作者绕过工作区级访问控制，读取任意作业的敏感执行数据并注入误导性进度。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Windmill Labs | Windmill | 0 ~ 1.783.0 | - |
|
II. Public POCs for CVE-2026-72542
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-72542
请登录查看更多情报信息。
Same Patch Batch · Windmill Labs · 2026-08-11 · 3 CVEs total
| CVE-2026-72541 | 6.5 MEDIUM | Windmill Labs Windmill - Missing Authorization |
| CVE-2026-72539 | 6.5 MEDIUM | Windmill Labs Windmill - Information Disclosure |
IV. Related Vulnerabilities
Same product: Windmill
-
CVE-2026-54136
Windmill: Resource-scoped API tokens can read script content -
CVE-2026-72541
Windmill Labs Windmill - Missing Authorization -
CVE-2026-72539
Windmill Labs Windmill - Information Disclosure -
CVE-2026-47107
Windmill < 1.703.2 Incorrect Default Permissions in nsjail C -
CVE-2026-33881
Windmill: Rogue Workspace Admins can inject code via unescap
Same weakness: CWE-306
-
CVE-2026-59808
AVideo Authentication Bypass via Unkeyed Video Hash Disclosu -
CVE-2026-48106
Arc Enterprise cluster replication accepts unauthenticated M -
CVE-2026-34949
Combodo iTop: Unauthenticated user can delete .readonly file -
CVE-2026-34741
Combodo iTop: Authentication bypass in exec.php allows PHP f -
CVE-2026-69228
missing authentication vulnerability in Esri Portal for ArcG
V. Comments for CVE-2026-72542
No comments yet