Hackers Exploit Windmill Flaw for Unauthenticated File Reads
A critical path traversal vulnerability in the open-source developer platform Windmill is being actively exploited, allowing attackers to read sensitive server files without authentication.
A critical security flaw in the open-source developer platform Windmill, identified as CVE-2026-29059, is currently being exploited in the wild. This vulnerability, with a CVSS score of 7.5, allows unauthenticated attackers to read arbitrary files from the server by exploiting a path traversal weakness in the 'get_log_file' endpoint. The flaw resides in how the 'filename' parameter is handled, as it is concatenated into a file path without proper sanitization, enabling attackers to use directory traversal sequences like '../' to access unintended files.
The primary impact of this vulnerability stems from the potential to read sensitive environment variables, particularly the SUPERADMIN_SECRET. By accessing the /proc/1/environ file, attackers can retrieve this secret, which, when present, can be used as a Bearer token to authenticate as a superadmin. This elevated access allows for arbitrary code execution through the job preview API. However, it's important to note that the SUPERADMIN_SECRET is not configured by default in all Windmill instances. For standalone deployments without this secret set, the vulnerability's impact is limited to arbitrary file read capabilities.
The vulnerability was officially addressed by the Windmill team in version 1.603.3, released in January 2026. The fix involved implementing sanitization checks for the 'filename' parameter to effectively prevent directory traversal attacks. Despite the patch being available, active exploitation indicates that many instances remain vulnerable.
Security researchers at VulnCheck, credited with discovering and reporting the flaw, have observed exploitation attempts targeting the 'get_log_file' endpoint. These attacks aim to extract sensitive information, including the contents of the /etc/passwd file, which lists user accounts on the system. Exploitation has been noted not only against direct Windmill endpoints but also through proxy paths, such as those used by Nextcloud.
VulnCheck's research identified approximately 170 vulnerable Windmill systems exposed across 24 different countries, highlighting a significant global attack surface. The active exploitation of this flaw underscores the persistent threat posed by unpatched open-source software and the importance of timely security updates.
This disclosure comes amidst a broader trend of actively exploited vulnerabilities being added to CISA's Known Exploited Vulnerabilities (KEV) catalog. While this specific Windmill vulnerability is not mentioned in the recent CISA KEV additions, other critical flaws in platforms like Langflow and WordPress have been highlighted, indicating a busy period for cybersecurity defenders.
The exploitation of CVE-2026-29059 serves as a stark reminder for organizations using Windmill to ensure they are running the latest patched version. Failure to do so leaves them susceptible to unauthorized access and potential system compromise, especially if the SUPERADMIN_SECRET is configured.