CVE-2026-72542 in Windmill
Summary
by MITRE • 08/11/2026
A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept no authorization extractor, bypassing workspace-level access controls. An operator can monitor sensitive job execution data and inject misleading progress for jobs they do not own.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
This vulnerability represents a critical authorization flaw in Windmill Labs Windmill platform version 1.783.0 and earlier, where authenticated users with operator privileges can bypass workspace-level access controls to manipulate job progress data and read metrics for any job within the workspace. The core technical issue stems from the absence of proper authorization extractors in the job_metrics API handlers, which should validate that operators have legitimate access rights before permitting operations on specific jobs. This missing authorization mechanism creates a privilege escalation path where malicious or compromised operators can monitor sensitive execution data and inject false progress information for jobs they do not own, effectively undermining the platform's security model and access control enforcement.
The operational impact of this vulnerability extends beyond simple data exposure to encompass potential operational disruption and security risks. An attacker with operator privileges could monitor the progress of confidential workflows, gaining insights into business-critical processes and potentially identifying vulnerabilities in other systems through job execution patterns. The ability to inject misleading progress data creates opportunities for deception attacks where false completion statuses or error messages could mislead system administrators and automated monitoring tools, potentially masking actual security incidents or causing operational failures. This vulnerability directly violates the principle of least privilege and could enable attackers to manipulate workflow execution states, affecting system integrity and availability.
The technical flaw aligns with CWE-285 (Improper Authorization) and represents a classic case of insufficient access control validation in API endpoints. From an ATT&CK framework perspective, this vulnerability maps to T1078 (Valid Accounts) and T1566 (Phishing) as it leverages existing operator privileges to escalate access, while also supporting T1496 (Resource Hijacking) through the ability to manipulate job progress data. The absence of authorization extractors in the job_metrics handlers creates an attack surface that allows unauthorized data manipulation even when proper authentication is in place, demonstrating a fundamental flaw in the platform's security architecture.
Mitigation strategies should focus on implementing proper authorization checks within the job_metrics API handlers and ensuring that all operations require explicit validation of user permissions against specific job resources. Organizations should enforce role-based access control policies where operators can only access jobs they own or have explicit permission to monitor, and implement comprehensive logging of all job progress modifications for audit purposes. The platform should be updated to version 1.784.0 or later, which addresses this authorization bypass vulnerability through proper access control enforcement mechanisms that validate workspace-level permissions before allowing any operations on job metrics or progress data. Additionally, organizations should conduct regular security assessments of API endpoints to ensure no similar authorization gaps exist in other parts of the platform's architecture.