A critical security vulnerability has been identified in Windmill, an open-source developer platform utilized for internal code management, including APIs, background jobs, workflows, and user interfaces. This flaw, designated as CVE-2026-29059 with a CVSS score of 7.5, permits unauthenticated attackers to perform path traversal attacks, enabling them to read arbitrary files on the server.
The vulnerability resides in Windmill’s “get_log_file” endpoint, specifically at “/api/w/{workspace}/jobs_u/get_log_file/{filename}”. The issue arises because the “filename” parameter is concatenated into a file path without proper sanitization. Consequently, attackers can exploit this by inserting “../” sequences to traverse directories and access sensitive files on the server.
One particularly concerning aspect of this vulnerability is the potential exposure of the SUPERADMIN_SECRET environment variable. This variable can be accessed through the “/proc/1/environ” file. If the SUPERADMIN_SECRET is set, an attacker could use it as a Bearer token to authenticate as a superadmin, thereby gaining the ability to execute arbitrary code via the job preview API. However, it’s important to note that the SUPERADMIN_SECRET is not set by default. In instances where this variable is not configured, the impact is limited to unauthorized file reads.
Windmill addressed this vulnerability in version 1.603.3, released in January 2026, by implementing sanitization checks on the “filename” parameter to prevent directory traversal attacks. Despite this patch, recent reports indicate that the vulnerability is being actively exploited. Security researchers have observed attackers targeting the “get_log_file” endpoint to extract sensitive information, such as the “/etc/passwd” file, which contains user account details.
Further analysis has revealed that approximately 170 vulnerable systems are exposed across 24 countries. Exploitation attempts have been detected not only against direct Windmill endpoints but also through proxy paths associated with other applications, such as Nextcloud.
This incident underscores the critical importance of timely software updates and vigilant monitoring of application security. Organizations utilizing Windmill should immediately upgrade to version 1.603.3 or later to mitigate this vulnerability. Additionally, implementing robust access controls and regularly auditing system configurations can help prevent unauthorized access and potential data breaches.
In the broader context, this exploitation highlights a concerning trend where attackers are increasingly targeting known vulnerabilities in widely used open-source platforms. It serves as a stark reminder for organizations to prioritize cybersecurity measures, including prompt patch management and continuous monitoring, to safeguard against evolving threats.
