Is CVE-2026-26964 actively exploited?

No active exploitation of CVE-2026-26964 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-26964 be exploited remotely?

Yes. CVE-2026-26964 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-26964?

CVE-2026-26964 has a CVSS score of 2.7 (LOW) and an EPSS exploitation probability of 0.03%.

HOME VULNERABILITIESCVE-2026-26964

LOW

CVE-2026-26964

CWE-200Published: February 20, 2026· Updated: Feb 20, 2026

2.7

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:6.7th

Official Description

Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Versions 1.634.6

and below allow non-admin users to obtain Slack OAuth client secrets, which should only be accessible to workspace administrators. The GET /api/w/{workspace}/workspaces/get_settings endpoint returns the slack_oauth_client_secret to any authenticated workspace member, regardless of their admin status. It is expected behavior for non-admin users see a redacted version of workspace settings, as some of them are necessary for the frontend to behave correctly even for non-admins. However, the Slack configuration should not be visible to non-admins. This is a legacy issue where the setting was stored as a plain value instead of using $variable indirection, and it was never added to the redaction logic. This issue has been fixed in version 1.635.0.

NVD Source

Technical Analysis

CVE-2026-26964 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

Exploitation requires high privileges, which limits the exposure to scenarios where an attacker has already gained initial access.

From a weakness classification perspective (CWE-200): Information exposure vulnerabilities leak sensitive data to unauthorized actors.