CVE-2026-47107

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-47107", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-05-18T19:22:26.748Z", "datePublished": "2026-05-19T16:42:55.144Z", "dateUpdated": "2026-11-08T14:04:05.882Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:04:05.882Z"}, "datePublic": "2026-05-17T00:00:00.000Z", "title": "Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration", "descriptions": [{"lang": "en", "value": "Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions, allowing authenticated users to write arbitrary entries to /etc/hosts, /etc/resolv.conf, and /etc/ssl/certs/ca-certificates.crt from within script execution sandboxes. Attackers can exploit persistent poisoned entries across all subsequent script executions on the same worker pod to redirect hostnames, intercept DNS queries, perform transparent HTTPS man-in-the-middle attacks, and intercept WM_TOKEN JWTs to gain workspace-admin access to other users' workspaces."}], "tags": ["x_open-source"], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-276", "description": "Incorrect Default Permissions", "type": "CWE"}]}], "affected": [{"defaultStatus": "affected", "packageURL": "pkg:github/windmill-labs/windmill", "vendor": "windmill-labs", "product": "windmill", "repo": "https://github.com/windmill-labs/windmill", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThan": "1.703.2"}, {"status": "unaffected", "version": "f8467f38c8a053117ce62f96684cfb15ef792f08", "versionType": "git"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:windmill:windmill:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.703.2"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 8.6, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N"}}], "references": [{"url": "https://github.com/windmill-labs/windmill/releases/tag/v1.703.2", "name": "Windmill 1.703.2 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/windmill-labs/windmill/pull/9194", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/windmill-labs/windmill/commit/f8467f38c8a053117ce62f96684cfb15ef792f08", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/windmill-incorrect-default-permissions-in-nsjail-configuration"}], "credits": [{"lang": "en", "value": "Shai Dvash", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "vulncheck"}}, "adp": [{"references": [{"url": "https://github.com/windmill-labs/windmill/pull/9194", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-19T18:36:00.934615Z", "id": "CVE-2026-47107", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T18:36:27.927Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-47107", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-05-19T18:36:00.934615Z"}}}], "references": [{"url": "https://github.com/windmill-labs/windmill/pull/9194", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-19T18:36:23.336Z"}}], "cna": {"tags": ["x_open-source"], "title": "Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Shai Dvash"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.6, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/windmill-labs/windmill", "vendor": "windmill-labs", "product": "windmill", "versions": [{"status": "affected", "version": "0", "lessThan": "1.703.2", "versionType": "semver"}, {"status": "unaffected", "version": "f8467f38c8a053117ce62f96684cfb15ef792f08", "versionType": "git"}], "packageURL": "pkg:github/windmill-labs/windmill", "defaultStatus": "affected"}], "datePublic": "2026-05-17T00:00:00.000Z", "references": [{"url": "https://github.com/windmill-labs/windmill/releases/tag/v1.703.2", "name": "Windmill 1.703.2 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/windmill-labs/windmill/pull/9194", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/windmill-labs/windmill/commit/f8467f38c8a053117ce62f96684cfb15ef792f08", "tags": ["patch"]}, {"url": "https://www.vulncheck.com/advisories/windmill-incorrect-default-permissions-in-nsjail-configuration"}], "x_generator": {"engine": "vulncheck"}, "descriptions": [{"lang": "en", "value": "Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions, allowing authenticated users to write arbitrary entries to /etc/hosts, /etc/resolv.conf, and /etc/ssl/certs/ca-certificates.crt from within script execution sandboxes. Attackers can exploit persistent poisoned entries across all subsequent script executions on the same worker pod to redirect hostnames, intercept DNS queries, perform transparent HTTPS man-in-the-middle attacks, and intercept WM_TOKEN JWTs to gain workspace-admin access to other users' workspaces."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-276", "description": "Incorrect Default Permissions"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:windmill:windmill:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.703.2"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:04:05.882Z"}}}, "cveMetadata": {"cveId": "CVE-2026-47107", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:04:05.882Z", "dateReserved": "2026-05-18T19:22:26.748Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-05-19T16:42:55.144Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "packageURL": "pkg:github/windmill-labs/windmill", "product": "windmill", "repo": "https://github.com/windmill-labs/windmill", "vendor": "windmill-labs", "versions": [{"lessThan": "1.703.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "f8467f38c8a053117ce62f96684cfb15ef792f08", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Windmill prior to 1.703.2 contains an incorrect default permissions vulnerability in nsjail sandbox configuration files where /etc is bind-mounted without read-write restrictions, allowing authenticated users to write arbitrary entries to /etc/hosts, /etc/resolv.conf, and /etc/ssl/certs/ca-certificates.crt from within script execution sandboxes. Attackers can exploit persistent poisoned entries across all subsequent script executions on the same worker pod to redirect hostnames, intercept DNS queries, perform transparent HTTPS man-in-the-middle attacks, and intercept WM_TOKEN JWTs to gain workspace-admin access to other users' workspaces."}, {"lang": "es", "value": "Windmill anterior a 1.703.2 contiene una vulnerabilidad de permisos predeterminados incorrectos en los archivos de configuraci\u00f3n del sandbox nsjail donde directorio etc se monta con bind sin restricciones de lectura-escritura, permitiendo a los usuarios autenticados escribir entradas arbitrarias en ficheros etc/hosts, ficheros etc/resolv.conf y ficheros etc/ssl/certs/ca-certificates.crt desde dentro de los sandboxes de ejecuci\u00f3n de scripts. Los atacantes pueden explotar entradas envenenadas persistentes en todas las ejecuciones de scripts posteriores en el mismo pod de trabajador para redirigir nombres de host, interceptar consultas DNS, realizar ataques transparentes de man-in-the-middle HTTPS e interceptar JWTs WM_TOKEN para obtener acceso de administrador de espacio de trabajo a los espacios de trabajo de otros usuarios."}], "id": "CVE-2026-47107", "lastModified": "2026-10-06T21:10:00.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-47107", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-05-19T18:36:00.934615Z", "version": "2.0.3"}}]}, "published": "2026-05-19T18:16:22.167", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/windmill-labs/windmill/commit/f8467f38c8a053117ce62f96684cfb15ef792f08"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/windmill-labs/windmill/pull/9194"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/windmill-labs/windmill/releases/tag/v1.703.2"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/windmill-incorrect-default-permissions-in-nsjail-configuration"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/windmill-labs/windmill/pull/9194"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-276"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,1.703.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "code_commit", "value": "f8467f38c8a053117ce62f96684cfb15ef792f08"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "windmill", "source": "cna", "vendor": "windmill-labs"}, "product": "windmill", "vendor": "windmill-labs"}], "created": "2026-05-19T18:30:11.022540+00:00", "updated": "2026-05-20T15:30:33.491835+00:00", "vendors": ["windmill-labs", "windmill-labs$PRODUCT$windmill"]}