Windmill CVE-2026-47107

Requires an authenticated Windmill account (PR:L) on any workspace of a multi-tenant deployment that uses nsjail-sandboxed workers and reuses worker pods across tenants - these are the default settings in affected versions <1.703.2. The attacker must be able to submit a script for execution (the normal capability of any workspace user) and must land on a worker pod that subsequently executes a victim's job; exploitation is therefore opportunistic per worker rather than directly targeted, which is why SSVC marks Automatable=no. No user interaction is required (UI:N), no privilege escalation inside the host is needed, and no special platform configuration beyond default nsjail bind-mounts is required. Limiting factors: single-tenant deployments, deployments that already pin workers per workspace, and deployments running Windmill v1.703.2 or later are not exploitable.

Signals converge on a real, exploitable issue but with a meaningful precondition. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N rates this 8.6: network reach, low complexity, low privileges required, no user interaction, and high confidentiality and integrity loss. SSVC reports Exploitation=poc (publicly available exploit code exists), Automatable=no (attackers cannot mass-spray it because each instance requires an authenticated workspace account), and Technical Impact=total - consistent with workspace-admin compromise. The CVE was reported by VulnCheck and a fix is shipped in v1.703.2. The vulnerability is not in CISA KEV at time of analysis and no EPSS score is provided in the input, so widespread opportunistic exploitation cannot be confirmed; risk is concentrated on multi-tenant Windmill deployments (SaaS or shared-worker self-hosted) where an attacker can obtain any authenticated user account in any tenant. Single-tenant deployments or those that already isolate workers per workspace face materially lower realistic risk.

An attacker registers or obtains any low-privilege user account in any workspace on a shared Windmill deployment and runs a script that appends entries to /etc/hosts (or installs a rogue CA into /etc/ssl/certs/ca-certificates.crt) inside the nsjail sandbox. When a victim workspace later schedules a job on the same worker pod, that job's outbound HTTPS calls resolve to attacker-controlled IPs and trust the attacker's CA, allowing transparent MITM and capture of the WM_TOKEN JWT the worker uses to call back into the Windmill API. With that token the attacker authenticates as the victim and assumes workspace-admin in the victim's tenant; publicly available exploit code exists per SSVC.