CVE-2026-54136: Windmill API Token Scope Bypass Vulnerability
Summary
CVE-2026-54136: A resource-scoped API token can read script contents outside its allowed path scope via GET /api/w/{workspace}/scripts/list_search. Affects windmill-api versions < 1.715.0. Fixed in 1.715.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Windmill is an open-source platform designed for automating workflows and managing scripts within workspaces. It allows users to create, manage, and execute scripts with the help of scoped API tokens that define permissions based on domain, action, and resource paths. However, a flaw in the token validation process can lead to unauthorized access to script contents outside the intended scope.
Vulnerability Detail
The vulnerability arises from a flaw in the route-level scope middleware that validates API tokens. While it checks the domain and action of the token, it fails to enforce the resource/path restrictions. This allows a resource-scoped API token, which should only access specific scripts, to read script contents from unrelated paths within the same workspace. The affected endpoint is 'GET /api/w/{workspace}/scripts/list_search', which can expose sensitive information such as internal logic, configuration details, and potentially hardcoded secrets.
How To Fix
Minimum fixed version
1.715.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the use of scoped API tokens to only those that are necessary and avoid using tokens with broad access until the package is updated.
Conclusion
The CVE-2026-54136 vulnerability in the Windmill platform poses a risk of unauthorized access to script contents through improperly validated API tokens. Users are advised to update to the patched version to ensure their scripts remain secure.
See every vulnerability recorded for windmill-api →
FAQ
CVE-2026-54136 is a vulnerability in the Windmill platform that allows API tokens to bypass resource path restrictions, potentially exposing sensitive script contents.
If you are using a scoped API token, it may allow unauthorized access to scripts that should be restricted, leading to potential data exposure.
You should update the 'windmill-api' package to version 1.715.0 or later to mitigate the vulnerability.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without requiring any signup.
The CVSS score of this vulnerability is 5.1, indicating a moderate level of risk.
