SQL Injection Vulnerability in Windmill CE and EE by Windmill Labs
CVE-2026-23696

9.4CRITICAL

Key Information:

Vendor

Windmill Labs

Status
Windmill Ce (community Edition)
Windmill Ee (enterprise Edition)
Flow
Vendor
CVE Published:
7 April 2026

Badges

👾 Exploit Exists

What is CVE-2026-23696?

Versions 1.276.0 through 1.603.2 of Windmill CE and EE have a security flaw in the folder ownership management feature that enables authenticated attackers to exploit SQL through the owner parameter. This vulnerability can lead to the unauthorized reading of sensitive data, including JWT signing secrets and administrative user identifiers. Additionally, attackers may forge administrative tokens and execute arbitrary code using the workflow execution endpoints, thereby posing a significant risk to system integrity and security.

Affected Version(s)

Flow 1.0.0 <= 1.2.2

Windmill CE (Community Edition) 1.276.0 <= 1.603.2

Windmill EE (Enterprise Edition) 1.276.0 <= 1.603.2

References

https://chocapikk.com/posts/2026/windfall-nextcloud-flow-...
technical-descriptionexploit
https://github.com/Chocapikk/Windfall
exploit
https://github.com/windmill-labs/windmill/releases/tag/v1...
release-notes

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Valentin Lobstein (Chocapikk)
.