CVE-2026-26964

Windmill CVE-2026-26964 affects Windmill versions 1.634.6 and earlier. The issue allows non-admin workspace members to access the Slack OAuth client secret via GET /api/w/{workspace}/workspaces/get_settings, revealing a secret that should be admin-only. Root cause: Slack configuration was stored ...

CVE-2026-26964 Windmill Exposes Workspace Slack OAuth Client Secrets to Non-Admin Workspace Members

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET...

PT-2026-20970

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6 and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET /api/w/workspace/workspaces/get...

CVE-2022-31519

The Lukasavicus/WindMill repository through 1.0 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

EUVD-2024-2794

Malicious code in bioql PyPI...

Malicious code in windmill-yacht-ovlz (npm)

The package windmill-yacht-ovlz was found to contain malicious code...

Malicious code in windmill-elderberry-gcsv (npm)

The package windmill-elderberry-gcsv was found to contain malicious code...

Malicious code in windmill-ginkgo-ti06 (npm)

The package windmill-ginkgo-ti06 was found to contain malicious code...

MAL-2025-39317 Malicious code in windmill-blackhole-ztfa (npm)

The package windmill-blackhole-ztfa was found to contain malicious code...

MAL-2025-39320 Malicious code in windmill-violet-emp2 (npm)

The package windmill-violet-emp2 was found to contain malicious code...

MAL-2025-31195 Malicious code in quasar-windmill-hhsy (npm)

The package quasar-windmill-hhsy was found to contain malicious code...

MAL-2025-22305 Malicious code in hazel-windmill-tyeg (npm)

The package hazel-windmill-tyeg was found to contain malicious code...

Malicious code in quasar-windmill-hhsy (npm)

The package quasar-windmill-hhsy was found to contain malicious code...

Malicious code in windmill-blackhole-ztfa (npm)

The package windmill-blackhole-ztfa was found to contain malicious code...

MAL-2025-39321 Malicious code in windmill-yacht-ovlz (npm)

The package windmill-yacht-ovlz was found to contain malicious code...

MAL-2025-39319 Malicious code in windmill-ginkgo-ti06 (npm)

The package windmill-ginkgo-ti06 was found to contain malicious code...

MAL-2025-28763 Malicious code in papa-windmill-d18h (npm)

The package papa-windmill-d18h was found to contain malicious code...

Malicious code in papa-windmill-d18h (npm)

The package papa-windmill-d18h was found to contain malicious code...

Malicious code in zulu-windmill-o3ly (npm)

The package zulu-windmill-o3ly was found to contain malicious code...

Malicious code in hazel-windmill-tyeg (npm)

The package hazel-windmill-tyeg was found to contain malicious code...