Windmill Labs up to 1.714.x Resource-scoped API Token list_search list_search_scripts hard-coded credentials

Summaryinfo

A vulnerability classified as problematic has been found in Windmill Labs Windmill up to 1.714.x. This affects the function list_search_scripts of the file /api/w/{workspace}/scripts/list_search of the component Resource-scoped API Token. The manipulation leads to hard-coded credentials. This vulnerability is documented as CVE-2026-54136. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Windmill Labs Windmill up to 1.714.x and classified as problematic. This issue affects the function list_search_scripts of the file /api/w/{workspace}/scripts/list_search of the component Resource-scoped API Token. The manipulation with an unknown input leads to a hard-coded credentials vulnerability. Using CWE to declare the problem leads to CWE-798. The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. Impacted is confidentiality. The summary by CVE is:

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to 1.715.0, a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search. The route-level scope middleware validated the token domain and action but did not enforce the resource/path segment, and the list_search_scripts handler had no additional check_scopes call or per-row filtering before returning script path and content fields. A token such as scripts:read:f/allowed/* could therefore receive source code for unrelated paths in the same workspace, potentially disclosing internal automation logic, integration details, business logic, inline configuration, or hardcoded secrets and credentials. Exploitation required possession of a valid scoped API token for the workspace but did not require administrator privileges. This issue is fixed in version 1.715.0.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-54136 since 06/11/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1110.001 according to MITRE ATT&CK.

Upgrading to version 1.715.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• Windmill Labs

Name

• Windmill

Version

• 1.714

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion