CVE-2026-23696: Windmill SQL Injection in Folder Ownership Handling Enables Token Forgery and Code Execution
CVE-2026-23696 is a critical SQL injection flaw (CWE-89) in the folder ownership management of Windmill Community and Enterprise Editions, affecting versions 1.276.0 through 1.603.2 according to the record. An authenticated attacker could use the owner parameter to read sensitive data, forge an administrative token and reach workflow execution endpoints. No confirmed exploitation appears in the sources consulted, and the record is still awaiting NVD analysis.
Overview
CVE-2026-23696 affects the Community Edition (CE) and Enterprise Edition (EE) of Windmill. According to the record, the flaw is an SQL injection in the folder ownership management functionality, triggered through the owner parameter by an authenticated user. The record describes a chain in which injected SQL exposes the JWT signing secret and administrative user identifiers, which could support forging an administrative token and then executing code through workflow execution endpoints.
Impact
- Confidentiality: the record states that sensitive data, including the JWT signing secret and administrative user identifiers, can be read.
- Integrity and privilege: the record states that an administrative token can be forged after the secret is exposed.
- Code execution: the record states that arbitrary code can be executed via workflow execution endpoints.
- Scoring: VulnCheck provides a CVSS 3.1 base score of 9.9 (critical) and a CVSS 4.0 score of 9.4. The NVD assessment is not yet available in the record.
Affected products and versions
- The record states that CE and EE versions from 1.276.0 through 1.603.2 are affected.
- The structured affected and fixes fields in the record are empty, so the affected list relies on the description text alone.
- The references include a release tagged 1.603.3 and a commit in the Windmill repository. The record does not explicitly state that these are the fix. Because the affected range ends at 1.603.2, a version after that range is the likely remediation target (inference). Confirm against the vendor release notes.
Exploitation status
The record shows that this CVE is not listed in the CISA KEV catalog, so active exploitation is not confirmed by that source. No confirmed exploitation appears in the sources consulted. The EPSS probability is 0.13582 with a percentile of 0.9639 as recorded; EPSS is a predictive estimate and does not confirm exploitation.
Remediation and mitigation
- Plan an upgrade to a Windmill release outside the stated affected range, prioritizing the 1.603.3 release referenced in the record once its contents are verified against the vendor notes.
- Until the upgrade is complete, restrict which accounts can change folder ownership and limit access to the Windmill instance from untrusted networks.
- After patching, consider rotating the JWT signing secret and reviewing existing administrative tokens and accounts, because the record describes exposure of these values.
Detection guidance
- Review audit logs for unexpected folder ownership changes and for owner values that do not match known users.
- Look for unexpected administrative actions, new privileged sessions, or workflow executions that the operators did not initiate.
- Monitor application error logs for database errors tied to folder ownership requests.
Limitations of the available information
- The record has no title, its source status is Awaiting Analysis, and NVD scoring is not yet present.
- The structured affected and fixed version fields are empty, so the exact fixed version is not confirmed by the record.
- The EPSS date in the record (2026-10-13) is later than the publication date, so it should be verified against the source before being relied upon.
- The exploitation chain is summarized from the record only; technical details were not available in the record.
Frequently asked questions
What does CVE-2026-23696 affect?
According to the record, Windmill Community and Enterprise Editions from 1.276.0 through 1.603.2 are affected by an SQL injection in folder ownership management.
Is this vulnerability known to be exploited?
The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do now?
Plan an upgrade beyond the affected range, restrict who can change folder ownership, and after patching consider rotating the JWT signing secret and reviewing administrative tokens.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.