CVE-2026-72539: Windmill Labs Windmill - Information Disclosure

Q: What is the severity of CVE-2026-72539?

CVE-2026-72539 has a medium severity score of 6.5.

Q: How does CVE-2026-72539 affect Windmill Labs Windmill?

CVE-2026-72539 allows authenticated workspace members to read ownerless draft scripts containing plaintext resource credentials.

Q: What versions of Windmill Labs Windmill are affected by CVE-2026-72539?

CVE-2026-72539 affects Windmill Labs Windmill version 1.783.0 and possibly earlier versions.

Q: How can I mitigate the risks associated with CVE-2026-72539?

To mitigate CVE-2026-72539, review and secure access controls for draft scripts to prevent unauthorized access.

Q: What does the information disclosure in CVE-2026-72539 mean for users?

The information disclosure in CVE-2026-72539 means that sensitive plaintext resource credentials can potentially be exposed to other workspace members.

Published Aug 11, 2026

Updated

An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace member who queries the drafts endpoint. Sensitive credentials stored in these drafts are exposed across ACL boundaries.

Affected Software

1 affected component

Windmill Labs Windmill<=1.783.0

Event History

Aug 11, 2026

CVE Published

via MITRE·11:07 AM

Data Sourced

via MITRE·11:07 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-72539?

CVE-2026-72539 has a medium severity score of 6.5.

How does CVE-2026-72539 affect Windmill Labs Windmill?

CVE-2026-72539 allows authenticated workspace members to read ownerless draft scripts containing plaintext resource credentials.

What versions of Windmill Labs Windmill are affected by CVE-2026-72539?

CVE-2026-72539 affects Windmill Labs Windmill version 1.783.0 and possibly earlier versions.

How can I mitigate the risks associated with CVE-2026-72539?

To mitigate CVE-2026-72539, review and secure access controls for draft scripts to prevent unauthorized access.

What does the information disclosure in CVE-2026-72539 mean for users?

The information disclosure in CVE-2026-72539 means that sensitive plaintext resource credentials can potentially be exposed to other workspace members.

CVE-2026-72539: Windmill Labs Windmill - Information Disclosure

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-72539?

How does CVE-2026-72539 affect Windmill Labs Windmill?

What versions of Windmill Labs Windmill are affected by CVE-2026-72539?

How can I mitigate the risks associated with CVE-2026-72539?

What does the information disclosure in CVE-2026-72539 mean for users?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-72539?

How does CVE-2026-72539 affect Windmill Labs Windmill?

What versions of Windmill Labs Windmill are affected by CVE-2026-72539?

How can I mitigate the risks associated with CVE-2026-72539?

What does the information disclosure in CVE-2026-72539 mean for users?