CVE-2026-72542

A missing authorization vulnerability in Windmill Labs Windmill through 1.783.0 allows authenticated operators to write job progress and read job metrics for any job in the workspace regardless of ownership. The job_metrics handlers accept no authorization extractor, bypassing workspace-level access controls. An operator can monitor sensitive job execution data and inject misleading progress for jobs they do not own.

• CWE-306

• https://github.com/windmill-labs/windmill

Published

Aug 11, 2026

Last Modified

Sep 3, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-72537A privilege escalation vulnerability in Authentik Security a…8.8
• CVE-2026-72538An argument injection vulnerability in PrefectHQ Prefect thr…8.8
• CVE-2026-72539An information disclosure vulnerability in Windmill Labs Win…6.5
• CVE-2026-7254IBM OPENBMC FW1110.00 through FW1110.11 is vulnerable to den…5.3
• CVE-2026-72540Rejected reason: Red Hat CNA-LR concluded that this CVE is n…
• CVE-2026-72541A missing authorization vulnerability in Windmill Labs Windm…6.5
• CVE-2026-72543An insecure direct object reference vulnerability in OpenSig…7.5
• CVE-2026-72544An integrity verification vulnerability in OpenSignLabs Open…7.5
• CVE-2026-72545An insecure direct object reference vulnerability in OpenSig…7.5
• CVE-2026-72546An insecure direct object reference vulnerability in Attendi…7.1
• CVE-2026-72547An insecure direct object reference vulnerability in Attendi…7.1
• CVE-2026-72548An information disclosure vulnerability in OpenSignLabs Open…7.5