/Vulnerability Library

Windmill < 1.603.3 - SQL Injection

CVE-2026-23696
Verified

Description

Windmill versions 1.276.0 through 1.603.2 contain an authenticated SQL injection vulnerability in the folder owner management endpoint. The addowner API endpoint passes user-supplied input directly into a SQL query without sanitization, enabling JSONB path injection. An authenticated user with operator-level access can extract sensitive data including JWT secrets, password hashes, API tokens, and database credentials, leading to full privilege escalation and remote code execution.

Severity

Critical

CVSS Score

9.9

Exploit Probability

14%

Affected Product

windmill

Published Date

July 21, 2026

Template Author

chocapikk, dhiyaneshdk

CVE-2026-23696.yaml
9.9Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVE ID:
cve-2026-23696
CWE ID:
cwe-89

References

https://github.com/Chocapikk/Windfallhttps://github.com/windmill-labs/windmill/commit/942fb629210ebb287f48467d1535ffde3a3eeafehttps://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/https://nvd.nist.gov/vuln/detail/CVE-2026-23696

Remediation Steps

Update Windmill to version 1.603.3 or later which sanitizes the owner input before SQL query construction.