OAuth Client Secrets Exposure in Windmill Developer Platform by Windmill Labs

CVE-2026-26964

What is CVE-2026-26964?

A vulnerability in the Windmill Developer Platform allows non-admin users to access sensitive Slack OAuth client secrets through the GET /api/w/{workspace}/workspaces/get_settings endpoint. This should only be accessible to workspace administrators. Users can receive unredacted workspace settings, which should not include Slack configuration details. The issue arises from legacy storage practices where values were stored plainly, leading to their visibility to unauthorized users. This vulnerability has been addressed in version 1.635.0.

References