Read the docs
TI-2026-18211 Aliases CVE-2026-22683GHSA-9q9g-rp9x-244h

Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE

Priority HIGH 73CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and raw_apps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.02609 85th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by the CNA
Fix Fixed Windmill CE (Community Edition) (Windmill Labs): 1.615.0Windmill EE (Enterprise Edition) (Windmill Labs): 1.615.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Windmill LabsWindmill CE (Community Edition)1.56.0 – 1.614.01.615.0Patch availableCNA
Windmill LabsWindmill EE (Enterprise Edition)1.56.0 – 1.614.01.615.0Patch availableCNA
  • Windmill CE (Community Edition) VendorWindmill Labs Affected 1.56.0 – 1.614.0 Fixed in 1.615.0 Patch available CNA
  • Windmill EE (Enterprise Edition) VendorWindmill Labs Affected 1.56.0 – 1.614.0 Fixed in 1.615.0 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:nextcloud:flow:*:*:*:*:*:*:*:*1.0.0 – 1.2.2Vulnerablenextcloud
cpe:2.3:a:windmill:windmill:*:*:*:*:*:*:*:*1.56.0 – 1.614.0VulnerableWindmill Labs
  • cpe:2.3:a:nextcloud:flow:*:*:*:*:*:*:*:* Versions 1.0.0 – 1.2.2 Vulnerable ·nextcloud
  • cpe:2.3:a:windmill:windmill:*:*:*:*:*:*:*:* Versions 1.56.0 – 1.614.0 Vulnerable ·Windmill Labs

Remediation

  • Fix · CNA Windmill CE (Community Edition) (Windmill Labs) Fixed in 1.615.0
  • Fix · CNA Windmill EE (Enterprise Edition) (Windmill Labs) Fixed in 1.615.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-22683
  2. 2026-10-03 Alias added: GHSA-9q9g-rp9x-244h

References

Exploit 2

Patch 1

Other 3

  • TI-2026-23204 Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly CVSS 4.0MEDIUM 6.9
  • TI-2026-26239 Code injection in windmill CVSS 4.0HIGH 7.3
  • TI-2026-21449 Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members CVSS 3.1LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences