Windmill vulnerabilities | LiveThreat CVE Feed

Product

Windmill

by Windmill · last CVE Apr 7, 2026

CVEs

On KEV

8.8

Max CVSS

New 30D

Severity mix

Critical 0High 3Medium 0Low 1

Severity

Exploitation

Watch

Add Windmill to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-22683	8.8	3%	Apr 7	Windmill < 1.615.0 Operator Role Missing Authorization Checks RCE Affected: 1.56.0 through 1.614.0
CVE-2026-29059	7.5	3%	Mar 6	Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly Affected: before 1.603.3
CVE-2026-33881	7.2	0%	Mar 27	Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor Affected: before 1.664.0