CVE-2026-23696 Scanner

Windmill is a software utilized for optimizing workflow automation and data management across various industries, including IT and business operations. It provides critical functionalities for managing tasks, organizing processes, and integrating different applications to streamline operations. Organizations rely on Windmill to monitor and automate their internal workflows, thereby enhancing productivity and efficiency. It is frequently employed by IT administrators and process managers due to its robust API support and customizable features. The software is designed to integrate seamlessly with existing platforms, allowing for comprehensive solutions for enterprise-level task management. It is leveraged by companies to minimize manual effort and reduce the likelihood of human error in repetitive process executions.

The SQL Injection vulnerability in Windmill allows an attacker to manipulate database queries by injecting malicious code into the input fields. This vulnerability affects versions 1.276.0 through 1.603.2 of the product. It occurs within the folder owner management endpoint, specifically the addowner API, which processes user-supplied input inadequately. An authenticated user can exploit this vulnerability to execute JSONB path injection that bypasses regular query parameters. This unauthorized access enables attackers to extract sensitive data from the database, leading to potential privilege escalation. As a result, critical information like JWT tokens, password hashes, and API credentials could be disclosed, posing a significant risk to data confidentiality and integrity.

The technical details of this vulnerability involve a lack of proper sanitization in the database querying process, allowing for SQL commands to be injected via the 'owner' parameter in the addowner API endpoint. The exploit utilizes a POST request to the vulnerable endpoint with carefully crafted payloads that manipulate database calls. Such interactions can result in JSONB path injections, bypassing the system's input validation mechanisms. The vulnerability is further exploited by authenticated users with operator-level access who can issue direct responses from the database using injected commands. By doing so, they gain unauthorized access to sensitive security parameters. Moreover, this exploitation can eventually lead to a complete system takeover through an admin token forgery attack.

If this SQL Injection vulnerability is exploited, attackers may extract JWT signing secrets from the database and craft valid admin tokens for privilege escalation. This escalation can evolve to super admin access, granting attackers the capability to execute arbitrary commands on the server. Such access violates data integrity and compromises the security posture of the affected systems. The potential outcomes include unauthorized administrative operations and the theft of restricted data, likely leading to substantial organizational damage and data breaches. Unauthorized actions executed by attackers could disrupt service availability and expose sensitive client and corporate information.

REFERENCES

• https://github.com/Chocapikk/Windfall
• https://github.com/windmill-labs/windmill/commit/942fb629210ebb287f48467d1535ffde3a3eeafe
• https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/
• https://nvd.nist.gov/vuln/detail/CVE-2026-23696