CVE-2026-23696CWE-89

Windmill < 1.603.3 File Ownership Handling SQLi RCE

Critical · published April 7, 2026

CVSS v4.0
9.4
EPSS
14%
Percentile
96.5
In the wild
Unconfirmed
What it is

Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.

The record
Technical detail
CVSS v4.0
9.4 · CRITICAL
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.13582 · 96.5th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2026-04-07T16:50Z
EPSS history
Timeline
  • 07 APR 16:50Z
    Windmill < 1.603.3 File Ownership Handling SQLi RCE
    cvelistv5