Windmill Vulnerability Lets Attackers Read Server Files Without Authorization

Researchers at VulnCheck have reported active exploitation of a serious vulnerability in Windmill, an open-source developer platform. The flaw in question is CVE-2026-29059 (CVSS score 7.5) — a directory traversal (path traversal) that requires no authentication.

The Nature of the Problem

The vulnerability affects the get_log_file endpoint at /api/w/{workspace}/jobs_u/get_log_file/{filename}. As noted in the project's own March advisory, the filename parameter is inserted into a file path without any sanitization. This allows an attacker to read arbitrary files on the server using ../ sequences.

The greatest danger lies in reading the SUPERADMIN_SECRET environment variable via /proc/1/environ. If this secret is set, it can be used as a Bearer token to log in with superadmin privileges and execute arbitrary code through the job preview API. That said, SUPERADMIN_SECRET is not set by default, and for standalone Windmill installations without this setting the impact is limited to file reading alone.

The issue was fixed back in Windmill version 1.603.3, released in January 2026: checks blocking directory traversal were added to the handling of the filename parameter.

What's Happening Now

According to VulnCheck (the vulnerability was discovered and reported by researcher Valentin Lobstein), attackers are hitting the get_log_file endpoint to extract the contents of the /etc/passwd file. The company's VP of security research, Caitlin Condon, noted that the exploits target both direct Windmill endpoints and the Nextcloud proxy path. In all, researchers counted around 170 vulnerable systems across 24 countries.

Not Just Windmill

In parallel, the U.S. agency CISA added four more flaws to its Known Exploited Vulnerabilities (KEV) catalog. Among them are two bugs in the WordPress core combined under the name wp2shell (CVE-2026-60137 and CVE-2026-63030), a buffer overflow in DD-WRT (CVE-2021-27137), and a remote code execution vulnerability in Langflow (CVE-2026-0770).

Wordfence calls wp2shell one of the most significant events in WordPress core security in recent years: the combination of unauthenticated access, no requirements for plugins or themes, a broad attack surface, and a published PoC makes the vulnerability chain extraordinarily dangerous.

U.S. federal civilian agencies have been ordered to remediate the listed vulnerabilities by July 24, 2026.

Source: The Hacker News