Resource-Scoped API Token Vulnerability in Windmill Developer Platform

CVE-2026-54136

What is CVE-2026-54136?

The Windmill developer platform, an open-source tool for managing APIs, workflows, and UIs, has a vulnerability that allows a resource-scoped API token to access script contents beyond its designated path. This occurs through the GET /api/w/{workspace}/scripts/list_search route, which improperly validates the token's resource/path segment. As a result, a user with a valid API token could potentially retrieve source code, business logic, or sensitive configurations from unrelated paths within the same workspace. Although the vulnerability requires possession of a valid token, it does not necessitate administrator privileges, raising concerns about the exposure of sensitive automation details. The issue has been addressed in version 1.715.0, mitigating the risk of such unauthorized data access.

References