CVE-2026-23696
Published: 07 April 2026
Summary
CVE-2026-23696 is a critical-severity SQL Injection (CWE-89) vulnerability. Its CVSS base score is 9.4 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 8.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-23696 is an SQL injection vulnerability affecting Windmill Community Edition (CE) and Enterprise Edition (EE) versions from 1.276.0 through 1.603.2. The flaw resides in the folder ownership management functionality, where authenticated attackers can inject malicious SQL payloads via the owner parameter. Assigned a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) and mapped to CWE-89, it was published on April 7, 2026.
Attackers with low-privilege authenticated access can exploit this vulnerability remotely with low complexity and no user interaction required. By injecting SQL, they can extract sensitive data such as the JWT signing secret and administrative user identifiers from the database. With this information, attackers can forge an administrative JWT token, escalate privileges, and achieve remote code execution by leveraging Windmill's workflow execution endpoints.
Mitigation is available through the patch committed at https://github.com/windmill-labs/windmill/commit/942fb629210ebb287f48467d1535ffde3a3eeafe and included in Windmill release v1.603.3 (https://github.com/windmill-labs/windmill/releases/tag/v1.603.3). Additional resources include a proof-of-concept exploit repository at https://github.com/Chocapikk/Windfall and a detailed analysis at https://chocapikk.com/posts/2026/windfall-nextcloud-flow-windmill-rce/, with a related Nextcloud Flow app release noted at https://apps.nextcloud.com/apps/flow/releases.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-19748
Vulnerability details
Windmill CE and EE versions 1.276.0 through 1.603.2 contain an SQL injection vulnerability in the folder ownership management functionality that allows authenticated attackers to inject SQL through the owner parameter. An attacker can use the injection to read sensitive data…
more
such as the JWT signing secret and administrative user identifiers, forge an administrative token, and then execute arbitrary code via the workflow execution endpoints.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SQL injection in public-facing Windmill web app directly enables remote exploitation for data access, token forgery, and RCE via T1190.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly prevents the SQL injection vulnerability by requiring validation of untrusted inputs such as the owner parameter to block malicious SQL payloads.
Ensures timely identification, reporting, and correction of the SQL injection flaw through patching, as demonstrated by the fix in Windmill v1.603.3.
Facilitates detection of SQL injection exploitation via monitoring for anomalous database queries and unauthorized access to sensitive data like JWT secrets.