CVE-2026-22683: Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE
Windmill versions 1.56.0 through 1.614.0 contain a missing authorization vulnerability that allows users with the Operator role to perform prohibited entity creation and modification actions via the backend API. Although Operators are documented and priced as unable to create or modify entities, the API does not enforce the Operator restriction on workspace endpoints, allowing an Operator to create and update scripts, flows, apps, and rawapps. Since Operators can also execute scripts via the jobs API, this allows direct privilege escalation to remote code execution within the Windmill deployment. This vulnerability has existed since the introduction of the Operator role in version 1.56.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Windmillto a version that resolves this vulnerability.Fixed in 1.615.0Patch Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE - Compensating control
Restrict access to Windmill workspace backend API endpoints so that only fully authorized roles can call endpoints used for script/flow/app/raw_app creation and modification (since Operator authorization checks are missing on workspace endpoints in 1.56.0 through 1.614.0).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-22683?
CVE-2026-22683 is a critical vulnerability due to the unauthorized access it allows Operators in Windmill versions 1.56.0 through 1.614.0.
How do I fix CVE-2026-22683?
To fix CVE-2026-22683, upgrade Windmill to version 1.615.0 or later.
What impacts does CVE-2026-22683 have on user roles?
CVE-2026-22683 allows users with the Operator role to perform unauthorized entity creation and modification actions.
Which versions of Windmill are affected by CVE-2026-22683?
CVE-2026-22683 affects Windmill versions from 1.56.0 to 1.614.0.
Is there a workaround for CVE-2026-22683?
Currently, there are no reported workarounds for CVE-2026-22683 other than upgrading the software.