ID:12429 - Exploit for Information disclosure in Windmill - CVE-2026-26964

Link to public exploit:

Vulnerability description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to the GET /api/w/{workspace}/workspaces/get_settings endpoint returns the slack_oauth_client_secret to any authenticated workspace member. A remote administrator can gain unauthorized access to sensitive information on the system.

Remediation