OAuth Client Secrets Exposure in Windmill Developer Platform by Windmill Labs

CVE-2026-26964

What is CVE-2026-26964?

A vulnerability in the Windmill Developer Platform allows non-admin users to access sensitive Slack OAuth client secrets through the GET /api/w/{workspace}/workspaces/get_settings endpoint. This should only be accessible to workspace administrators. Users can receive unredacted workspace settings, which should not include Slack configuration details. The issue arises from legacy storage practices where values were stored plainly, leading to their visibility to unauthorized users. This vulnerability has been addressed in version 1.635.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References