Medium severity · published Aug 11, 2026
CVE-2026-72539
Windmill Labs Windmill - Information Disclosure
6.5
CVSS
0.4%
EPSS
No
On KEV
Description
An information disclosure vulnerability in Windmill Labs Windmill through 1.783.0 allows any authenticated workspace member to read legacy ownerless draft scripts that contain plaintext resource credentials. Drafts with a null owner email bypass ACL enforcement and are returned to any workspace member who queries the drafts endpoint. Sensitive credentials stored in these drafts are exposed across ACL boundaries.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 34% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
Windmill · Windmill Labs
through 1.783.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-72539
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-72539
github.com
https://github.com/windmill-labs/windmill
More from Windmill
8.1
CVE-2026-47107
Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration
7.5
CVE-2026-29059
Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly
7.2
CVE-2026-33881
Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor
6.5
CVE-2026-72541
Windmill Labs Windmill - Missing Authorization
5.4
CVE-2026-72542
Windmill Labs Windmill - Missing Authorization