CVE-2026-23696: Windmill CE/EE SQL Injection Vulnerability

CVE-2026-23696 Overview

CVE-2026-23696 is a critical SQL injection vulnerability affecting Windmill CE and EE versions 1.276.0 through 1.603.2. The flaw exists in the folder ownership management functionality, where authenticated attackers can inject malicious SQL commands through the owner parameter. Successful exploitation enables attackers to extract sensitive data including JWT signing secrets and administrative user identifiers, forge administrative tokens, and ultimately achieve arbitrary code execution via workflow execution endpoints.

Critical Impact

This SQL injection vulnerability enables a complete attack chain from authenticated user to full system compromise through JWT secret extraction, token forgery, and remote code execution via workflow endpoints.

Affected Products

• Windmill Community Edition (CE) versions 1.276.0 through 1.603.2
• Windmill Enterprise Edition (EE) versions 1.276.0 through 1.603.2

Discovery Timeline

• 2026-04-07 - CVE-2026-23696 published to NVD
• 2026-04-08 - Last updated in NVD database

Technical Details for CVE-2026-23696

Vulnerability Analysis

This vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). The SQL injection flaw resides in how Windmill handles the owner parameter within its folder ownership management functionality. When an authenticated user submits a request to modify folder ownership, the application fails to properly sanitize or parameterize the owner input before incorporating it into SQL queries executed against the backend database.

The attack chain is particularly dangerous because it enables multi-stage exploitation. An attacker first leverages the SQL injection to read sensitive configuration data from the database, including the JWT signing secret used to authenticate administrative sessions. With this secret in hand, the attacker can forge a valid administrative JWT token without needing actual administrative credentials. Finally, using this forged administrative token, the attacker gains access to workflow execution endpoints, which provide the capability to execute arbitrary code on the underlying system.

Root Cause

The root cause is insufficient input validation and the lack of parameterized queries in the folder ownership management code path. User-supplied input from the owner parameter is concatenated directly into SQL statements rather than being passed as a bound parameter, allowing attackers to break out of the intended query structure and inject additional SQL commands.

Attack Vector

The attack is network-based and requires low-privilege authentication to the Windmill platform. An attacker with any valid user account can craft malicious requests to the folder ownership management endpoint, injecting SQL payloads through the owner parameter. The injection allows the attacker to perform UNION-based or blind SQL injection attacks to extract sensitive database contents.

Once the JWT signing secret is extracted, the attacker crafts a forged administrative token locally. This token is then used to authenticate to privileged API endpoints, specifically workflow execution endpoints that allow arbitrary script or command execution. This transforms a relatively constrained SQL injection vulnerability into full remote code execution.

Technical details and proof-of-concept information are available in the Chocapikk Blog RCE Analysis and the Chocapikk GitHub Repository.

Detection Methods for CVE-2026-23696

Indicators of Compromise

• Unusual SQL error messages or database exceptions in Windmill application logs related to folder ownership operations
• HTTP requests to folder ownership endpoints containing SQL metacharacters such as single quotes, UNION keywords, or comment sequences (--, /*)
• Evidence of JWT tokens with unexpected claims or forged administrative privileges
• Anomalous workflow executions initiated by non-administrative accounts or containing suspicious commands

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block SQL injection patterns in requests to Windmill endpoints
• Monitor application logs for SQL syntax errors that may indicate injection attempts
• Implement database query auditing to detect unusual SELECT statements targeting JWT secrets or user tables
• Review authentication logs for administrative token usage patterns that don't match expected administrator behavior

Monitoring Recommendations

• Enable detailed logging for all folder ownership management API calls and inspect for malformed input
• Set up alerts for workflow executions that spawn shells, download external payloads, or access sensitive system files
• Monitor for new administrative sessions or privilege changes that correlate with folder ownership modifications
• Track database queries for anomalous patterns such as UNION-based data extraction or information schema enumeration

How to Mitigate CVE-2026-23696

Immediate Actions Required

• Upgrade Windmill CE or EE to version 1.603.3 or later immediately
• Audit recent folder ownership changes and workflow executions for signs of exploitation
• Rotate JWT signing secrets and invalidate all existing sessions to prevent use of potentially forged tokens
• Review administrative account activity and verify no unauthorized privilege escalation occurred

Patch Information

Windmill Labs has released version 1.603.3 which addresses this vulnerability. The fix is documented in the Windmill Labs Commit Update. Users should upgrade to the patched version available at the Windmill Labs Release v1.603.3. Additional technical details are available in the VulnCheck SQLi/RCE Advisory.

Workarounds

• Implement network-level access controls to restrict which users and networks can access Windmill administrative endpoints
• Deploy a WAF with SQL injection detection rules in front of Windmill instances as a temporary protective measure
• Consider temporarily disabling folder ownership management functionality if operationally feasible until patching is complete
• Enforce strict input validation at the application perimeter using a reverse proxy with request inspection capabilities

# Example: Restrict access to Windmill folder management endpoints using nginx
location /api/w/folder {
    # Allow only trusted internal networks
    allow 10.0.0.0/8;
    deny all;
    
    proxy_pass http://windmill_backend;
}