Windmill CVE-2026-72539

The attacker must hold a valid authenticated account within the target Windmill workspace (CVSS PR:L confirmed). The victim environment must contain at least one legacy draft script with a null owner email field - these are described as 'ownerless' drafts that arise from historical or migrated data rather than the default creation flow. The draft must also contain embedded plaintext resource credentials (e.g., database URIs, API tokens). Exploitation is limited to the confidentiality of those specific credentials - no integrity or availability impact is possible through this vector. Exploitation is bounded by: (1) requiring workspace-level authentication, which limits external threat actors; (2) requiring the existence of legacy null-owner drafts, which may not be present in all deployments; and (3) no scope change, meaning the attacker cannot leverage this vulnerability alone to pivot within the Windmill host.

The NVD-assigned CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) accurately reflects the threat profile. The network-accessible attack vector and low complexity mean exploitation requires nothing beyond a valid workspace account and knowledge of the drafts endpoint - no privilege escalation, no user interaction. The high confidentiality impact is justified because the exposed data is plaintext credentials, not just metadata. No EPSS score was provided in the intelligence data, and the vulnerability is not currently in CISA KEV, indicating no confirmed active exploitation. No public POC has been identified. The real-world risk is therefore contingent on two factors: whether an organization has legacy ownerless drafts in its Windmill instance, and whether those drafts contain live credentials. For organizations using Windmill extensively as an automation hub with long-lived drafts, the practical risk is elevated despite the moderate CVSS score. For fresh deployments without orphaned drafts, exposure is likely minimal. No conflicting signals between CVSS and description - both clearly indicate network-accessible, authenticated, low-complexity exploitation.

An attacker with a valid Windmill workspace account - such as a low-privilege developer or contractor - sends an authenticated GET request to the drafts API endpoint. The server returns all ownerless drafts due to the null-owner ACL bypass, exposing plaintext database passwords, API keys, or OAuth tokens embedded in legacy automation scripts. The attacker then uses those credentials to access external databases or third-party services outside the Windmill platform entirely.