Windmill < 1.603.3 - SQL Injection
Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with operator-level access can extract sensitive data including JWT secrets, password hashes, API tokens, and database credentials, leading to full privilege escalation and remote code execution. References: https://github.com/Chocapikk/Windfall https://github.com/windmill-labs/windmill/commit/942fb629210ebb287f48467d1535ffde3a3eeafe https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/ https://nvd.nist.gov/vuln/detail/CVE-2026-23696 Remediation: Update Windmill to version 1.603.3 or later which sanitizes the owner input before SQL query construction.
Used 18 times · 9 assets checked · domain, subdomain, ipv4