CVE-2026-72539 — Windmill Labs Windmill - Information Disclosure
An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain p…
Published: 2026-08-11 · CVSS: 6.5 · CVSS 3.1
An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace member who queries the drafts endpoint. Sensitive credentials stored in these drafts are exposed across ACL boundaries.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7