Nextcloud Flow – Code Execution as Root via the Windmill Component
Through a vulnerability in the Windmill component of the Nextcloud app 'Flow', attackers can gain administrator access without logging in and run code as root in the container. A public exploit tool exists. Flow 1.3.0 fixes the issue.
Update of October 22, 2026
We have aligned the severity with Nextcloud's rating (CVSS 8.8, High; previously listed here as Critical) and added that a public exploit tool is now available.
What happened?
Nextcloud's automation app "Flow" ships a vulnerable version of the Windmill workflow engine. An unauthenticated attacker can use it to read Windmill's super-admin secret and log in as super admin. From there, they can read files, steal the admin tokens stored in windmill_users_config.json and run code as root in the container. This puts the connected Nextcloud instance, its files and user accounts at risk.
Nextcloud fixed the issue in Flow 1.3.0 (released January 13, 2026; advisory GHSA-g7vj-98x3-qvjf of March 6, 2026). A public exploit tool ("Windfall") that uses the flaw is now available.
Who is affected?
- SMEs that self-host Nextcloud and use the "Flow" app before version 1.3.0
- IT service providers in CH/FL running Nextcloud instances for customers
- Anyone running Windmill standalone: Windmill versions before 1.603.3 are affected
- Particularly exposed: instances reachable from the internet
What needs to be done?
- Update: Update the Flow app to version 1.3.0 or later, via the Nextcloud App Store or the CLI (
occ app:update flow). Update standalone Windmill installations to 1.603.3 or later. - If you cannot update right away: Disable the Flow app in the Nextcloud settings and stop the associated Windmill container.
- Check for compromise: Review the access logs for unauthorized access to Windmill or to the file
windmill_users_config.json. If in doubt, rotate the admin tokens and credentials. - Harden: Configure the Nextcloud instance according to Nextcloud's hardening recommendations.
This advisory is for informational purposes. Contact us for a security review of your Nextcloud instance.
Ready to know your attack surface?
Tell us briefly about your project. We'll come back with a concrete proposal.
Request a first call