PatchSiren cyber security CVE debrief

CVE-2026-54136 windmill-labs CVE debrief

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. A vulnerability in Windmill versions prior to 1.715.0 allows a resource-scoped API token to read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search. The route-level scope middleware validated the token domain and action but did not enforce the resource/path segment, and the list_search_scripts handler had no additional check_scopes call or per-row filtering before returning script path and content fields. A token such as scripts:read:f/allowed/* could therefore receive source code for unrelated paths in the same workspace, potentially disclosing internal automation logic, integration details, business logic, inline configuration, or hardcoded secrets and credentials. Exploitation required possession of a valid scoped API token for the workspace but did not require administrator privileges. This issue is fixed in version 1.715.0. Organizations should verify their current configurations and ensure proper scoping of API tokens to prevent unauthorized access to script content. Additionally, defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. To ensure proper mitigation, organizations should confirm whether affected product deployments exist in their managed environments and assign an owner for follow-up. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, organizations should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. Finally, they should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Vendor: windmill-labs
Product: windmill
CVSS: MEDIUM 5.1
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-08-20
Original CVE updated: 2026-08-21
Advisory published: 2026-08-20
Advisory updated: 2026-08-21

Who should care

Organizations using Windmill should be aware of this vulnerability and take steps to update their systems to version 1.715.0 or later to prevent unauthorized access to script content. Affected operators, platforms, and security teams should review and update their API tokens to ensure proper scoping and validate their current configurations against the patched version 1.715.0. Vulnerability management and security teams should prioritize this issue and plan vendor-supported updates or mitigations through normal change control where exposure is confirmed. Additionally, defenders should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. Compensating controls should be reviewed for exposed systems while remediation is scheduled and verified. An owner should be assigned for follow-up on affected product deployments in managed environments. The official CVE record and NVD detail page provide further information on the vulnerability and its impact. To ensure proper mitigation, organizations should confirm whether affected product deployments exist in their managed environments and assign an owner for follow-up. They should also plan vendor-supported updates or mitigations through normal change control where exposure is confirmed and review compensating controls for exposed systems while remediation is scheduled and verified. Additionally, organizations should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, retest remediated assets, and close the item only after evidence is documented. Finally, they should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance. The CVE details indicate that a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search in Windmill versions prior to 1.715.0. This issue is fixed in version 1.715.0. Organizations should verify their current configurations and ensure proper scoping of API tokens to prevent

Technical summary

A vulnerability in Windmill versions prior to 1.715.0 allows a resource-scoped API token to read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search. This issue is fixed in version 1.715.0. The vulnerability requires possession of a valid scoped API token for the workspace but does not require administrator privileges. Exploitation could potentially disclose internal automation logic, integration details, business logic, inline configuration, or hardcoded secrets and credentials.

Defensive priority

Organizations using Windmill should review and update their API tokens to ensure proper scoping and validate their current configurations against the patched version 1.715.0.

Recommended defensive actions

Review and update API tokens to ensure proper scoping
Validate current configurations against the patched version 1.715.0
Implement compensating controls to monitor and restrict access to sensitive script content
Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE details indicate that a resource-scoped API token could read script contents outside its allowed path scope through GET /api/w/{workspace}/scripts/list_search in Windmill versions prior to 1.715.0. This issue is fixed in version 1.715.0. Organizations should verify their current configurations and ensure proper scoping of API tokens to prevent unauthorized access to script content. Additionally, defenders should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-08-20T17:18:17.737Z and has not been modified since then.