Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

Attackers actively exploit CVE-2026-29059, a high-severity vulnerability in Windmill, an open-source developer platform. The flaw carries a CVSS score of 7.5 and allows unauthenticated users to read arbitrary files from affected servers without logging in.

The vulnerability exists in Windmill's "get_log_file" endpoint at "/api/w/{workspace}/jobs_u/get_log_file/{filename}". The endpoint fails to properly validate the filename parameter, enabling path traversal attacks. Attackers can craft malicious requests using directory traversal sequences like "../" to navigate outside intended log directories and access sensitive files on the underlying system.

No authentication requirement compounds the risk. Attackers exploit the flaw remotely without valid credentials, making exploitation trivial for anyone with network access to a vulnerable Windmill instance. VulnCheck confirmed active exploitation occurring in the wild, indicating threat actors have weaponized the vulnerability.

Organizations running Windmill face immediate exposure to information disclosure attacks. Attackers can extract configuration files, API keys, database credentials, source code, and other sensitive data stored on affected servers. The retrieved information enables follow-on attacks like lateral movement, privilege escalation, or credential compromise.

The vulnerability affects Windmill deployments that haven't applied patches addressing CVE-2026-29059. Administrators should prioritize updating to a patched version immediately. Organizations unable to upgrade immediately should restrict network access to Windmill instances using firewall rules or network segmentation, limiting exposure to trusted internal networks only.

The path traversal flaw represents a common but dangerous class of vulnerability. Proper input validation and canonicalization of file paths prevents such attacks. Windmill maintainers should ensure all user-supplied filename parameters undergo strict validation against whitelisted patterns before filesystem operations.

Customers should audit