EUVD-2026-63484Published
Windmill: Resource-scoped API tokens can read script contents outside their allowed path via scripts/list_search
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-54136 · Microsoft / collected KEV context
cve-program · CVE-2026-54136
- https://github.com/windmill-labs/windmill/security/advisories/GHSA-2ppx-66jv-wpw5
- https://github.com/windmill-labs/windmill/pull/9426
- https://github.com/windmill-labs/windmill/commit/7edf3f02122e20fde1e95e0252e7bda641075326
- https://github.com/windmill-labs/windmill/releases/tag/v1.715.0
euvd · EUVD-2026-63484
- https://github.com/windmill-labs/windmill/security/advisories/GHSA-2ppx-66jv-wpw5
- https://github.com/windmill-labs/windmill/pull/9426
- https://github.com/windmill-labs/windmill/commit/7edf3f02122e20fde1e95e0252e7bda641075326
- https://github.com/windmill-labs/windmill/releases/tag/v1.715.0
nvd · CVE-2026-54136
- https://github.com/windmill-labs/windmill/commit/7edf3f02122e20fde1e95e0252e7bda641075326
- https://github.com/windmill-labs/windmill/pull/9426
- https://github.com/windmill-labs/windmill/releases/tag/v1.715.0
- https://github.com/windmill-labs/windmill/security/advisories/GHSA-2ppx-66jv-wpw5
osv · GHSA-2ppx-66jv-wpw5
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.