Read the docs
TI-2026-34705 Aliases CVE-2026-47107GHSA-78hq-926c-2xmr

Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration

Priority HIGH 72CWE-276Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions, allowing authenticated users to write arbitrary entries to /etc/hosts, /etc/resolv.conf, and /etc/ssl/certs/ca-certificates.crt from within script execution sandboxes. Attackers can exploit persistent poisoned entries across all subsequent script executions on the same worker pod to redirect hostnames, intercept DNS queries, perform transparent HTTPS man-in-the-middle attacks, and intercept WM_TOKEN JWTs to gain workspace-admin access to other users' workspaces.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0028 20th percentileScored 2026-11-07
Fix Fixed windmill (windmill-labs): 1.703.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Windmill Labswindmillbefore 1.703.21.703.2Patch availableCNA
  • windmill VendorWindmill Labs Affected before 1.703.2 Fixed in 1.703.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:windmill:windmill:*:*:*:*:*:*:*:*——Windmill Labs
  • cpe:2.3:a:windmill:windmill:*:*:*:*:*:*:*:* Versions — — ·Windmill Labs

Remediation

  • Fix · CNA windmill (windmill-labs) Fixed in 1.703.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-47107
  2. 2026-10-03 Alias added: GHSA-78hq-926c-2xmr

References

Patch 1

Other 2

  • TI-2026-19080 Windmill < 1.603.3 File Ownership Handling SQLi RCE CVSS 4.0CRITICAL 9.4
  • TI-2026-18211 Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE CVSS 4.0HIGH 8.7
  • TI-2026-23204 Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly CVSS 4.0MEDIUM 6.9
  • TI-2026-26239 Code injection in windmill CVSS 4.0HIGH 7.3
  • TI-2026-50800 Windmill Labs Windmill - Missing Authorization CVSS 3.1MEDIUM 6.5
  • TI-2026-50799 Windmill Labs Windmill - Information Disclosure CVSS 3.1MEDIUM 6.5
See all 9 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences