CVE-2026-29059: Windmill Path Traversal — Unauthenticated File Read Exploited (July 2026)

CVE-2026-29059 — Windmill Path Traversal Vulnerability

CVE-2026-29059 is a high-severity path traversal vulnerability in the Windmill open-source developer platform. The flaw allows unauthenticated attackers to read arbitrary files on affected servers. Active exploitation has been confirmed, with attackers targeting exposed endpoints to extract sensitive data, including authentication secrets. No CVSS score is published, but the risk is critical due to active attacks and potential for privilege escalation.

Attack Vector

Attackers exploit the get_log_file endpoint and Nextcloud proxy paths in Windmill to perform directory traversal, bypassing input validation and accessing files outside intended directories. Public exploitation attempts have retrieved files such as /etc/passwd and environment variables, notably SUPERADMIN_SECRET. If this secret is exposed, attackers can generate superadmin tokens, enabling arbitrary code execution. Indicators of compromise include unusual requests to log file endpoints and access to sensitive files without authentication.

Who Is at Risk

All organizations running exposed Windmill servers are at risk, especially those with public-facing deployments. Approximately 170 systems have been identified as vulnerable worldwide. Both Windmill and VulnCheck have confirmed exploitation in the wild. Systems with the SUPERADMIN_SECRET environment variable set are at heightened risk of privilege escalation.

Patch & Mitigate

• Patch: Update Windmill to the latest patched version as soon as possible. Check vendor advisories for specific release details and deadlines.
• Workaround: Restrict public access to Windmill endpoints and remove or rotate sensitive environment variables, especially SUPERADMIN_SECRET, until patching is complete.
• Detect: Review server logs for unauthenticated requests to /api/core/get_log_file and Nextcloud proxy paths. Monitor for access to sensitive files and unexpected authentication events.

MITRE ATT&CK

• TA0005 — Defense Evasion: Attackers bypass access controls to read files outside intended directories.
• TA0007 — Discovery: Adversaries enumerate and extract sensitive files to escalate privileges or prepare further attacks.

Source: https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html