CVE-2026-23696: exploitation status and patch state
CVE-2026-23696 · CVSS 9.9 CRITICAL · EPSS 16%
Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.
Is CVE-2026-23696 exploited?
Not in the CISA KEV catalog.
EPSS puts exploitation in the next 30 days at 16%.
Public exploit code: none found in monitored sources.
Public detection rules exist.
Which products and versions are affected?
No affected package list recorded here yet.
Is there a patch?
No patch identifier recorded here yet.
What PlainSec published about CVE-2026-23696
PlainSec has not published a story about this CVE.