CVE-2026-72542 Overview
CVE-2026-72542 is a missing authorization vulnerability in Windmill Labs Windmill through version 1.783.0. The flaw resides in the job_metrics handlers, which accept no authorization extractor and bypass workspace-level access controls. Authenticated operators can write job progress and read job metrics for any job in the workspace, regardless of ownership. An attacker with operator credentials can monitor sensitive job execution data belonging to other users and inject misleading progress values into jobs they do not own. The weakness is categorized under CWE-306: Missing Authentication for a Critical Function.
Critical Impact
Authenticated operators can read metrics and manipulate progress for any job in a Windmill workspace, breaking tenant isolation between job owners.
Affected Products
- Windmill Labs Windmill through 1.783.0
- Deployments exposing the job_metrics handler endpoints
- Multi-tenant Windmill workspaces where operators do not own all jobs
Discovery Timeline
- 2026-08-11 - CVE CVE-2026-72542 published to NVD
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-72542
Vulnerability Analysis
Windmill is a developer platform for building internal tools, workflows, and data pipelines. It uses workspace-scoped role-based access controls to isolate jobs between users. Operators are a lower-privilege role expected to execute assigned jobs, not to inspect or influence arbitrary jobs across the workspace.
The job_metrics handlers expose two functions: reading metrics for a job and writing progress updates for a job. Both operations should require verification that the caller owns or has been granted access to the target job. This vulnerability breaks that contract.
Successful abuse yields two effects. First, an operator can enumerate metrics for jobs owned by administrators or other users, exposing execution timing, resource consumption, and intermediate progress data that may reveal sensitive workflow information. Second, an operator can inject false progress values, misleading dashboards and downstream automation that consume job metrics.
Root Cause
The root cause is the absence of an authorization extractor on the job_metrics route handlers. Windmill's HTTP layer typically applies extractors that resolve the caller's role and enforce workspace-scoped permissions before invoking handler logic. The affected handlers omit this extractor, so the request proceeds using only authentication, with no ownership or role check on the target job_id.
Attack Vector
Exploitation requires network access to the Windmill API and valid operator credentials in the target workspace. The attacker issues authenticated HTTP requests to the job_metrics endpoints with an arbitrary job_id value. Because no authorization check occurs, the server returns metrics or accepts progress writes for the specified job. No user interaction from the job owner is required. Refer to the Windmill project repository for endpoint details and upstream fixes.
Detection Methods for CVE-2026-72542
Indicators of Compromise
- Requests to job_metrics endpoints from operator accounts referencing job_id values the operator did not create.
- Unexpected or non-monotonic progress values written to jobs, particularly progress updates from user accounts other than the job owner.
- High-volume enumeration of job_id values by a single authenticated session against job_metrics routes.
Detection Strategies
- Correlate Windmill API access logs against workspace ownership records to flag job_metrics requests where the caller is not the job owner or an administrator.
- Alert on operator-role principals accessing job telemetry outside of their assigned queues.
- Baseline expected read and write rates on the job_metrics handlers and alert on statistical outliers.
Monitoring Recommendations
- Forward Windmill application and reverse-proxy logs to a central analytics platform with job_id, user_id, and workspace_id fields parsed.
- Enable audit logging on all workspace role changes so operator-role expansions can be reviewed after incidents.
- Monitor egress from Windmill hosts for anomalous exfiltration patterns following operator authentication events.
How to Mitigate CVE-2026-72542
Immediate Actions Required
- Upgrade Windmill to a release later than 1.783.0 that adds the missing authorization extractor to the job_metrics handlers.
- Audit the operator role membership in each workspace and remove accounts that do not require operator privileges.
- Review recent job_metrics access logs for evidence of cross-owner reads or progress writes.
Patch Information
The fix adds an authorization extractor to the job_metrics read and write handlers so that requests are validated against workspace-level access controls before the handler executes. Track upstream commits and release notes in the Windmill project repository and apply the first release that includes the authorization enforcement on these routes.
Workarounds
- Restrict network access to the Windmill API so that only trusted principals can reach job_metrics routes while a patched version is deployed.
- Temporarily block or rate-limit the job_metrics endpoints at a reverse proxy for non-administrator sessions.
- Segregate sensitive workflows into dedicated workspaces that contain no operator-role members until upgrade is complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
