CVE-2026-23696

CRITICAL NUCLEI LAB

Windmill < 1.603.3 File Ownership Handling SQLi RCE

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2026-23696 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.

Nuclei Templates (1)

Windmill < 1.603.3 - SQL Injection
CRITICALVERIFIEDby chocapikk,DhiyaneshDk

References (7)

Core 7

Scores

CVSS v3 9.9
EPSS 0.1602
EPSS Percentile 96.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Lab Environment

COMMUNITY SUSPICIOUS
Community Lab
docker pull nextcloud/all-in-one:latest
docker pull ghcr.io/windmill-labs/windmill:1.394.4
docker pull ghcr.io/windmill-labs/windmill:1.603.2
docker pull curlimages/curl:latest

Details

CWE
CWE-89
Status published
Products (7)
Nextcloud/Flow 1.0.0 - 1.2.2
Nextcloud/Flow 1.3.0
Nextcloud/Flow 1.3.1
Windmill Labs/Windmill CE (Community Edition) 1.276.0 - 1.603.2
Windmill Labs/Windmill CE (Community Edition) 1.603.3
Windmill Labs/Windmill EE (Enterprise Edition) 1.276.0 - 1.603.2
Windmill Labs/Windmill EE (Enterprise Edition) 1.603.3
Published Apr 07, 2026
Tracked Since Apr 07, 2026