Developer Platform Threat: Unauthenticated Windmill Path Traversal Flaw CVE-2026-29059 Exploited in the Wild
Executive Summary
A critical vulnerability impacting the popular open-source developer workflow and automation platform Windmill has come under active, automated in-the-wild exploitation. Tracked as CVE-2026-29059 (CVSS score: 7.5), the flaw is an unauthenticated directory path traversal vulnerability residing within Windmill’s job execution logging endpoints.
Cybersecurity threat intelligence provider VulnCheck warned that automated threat scanners are actively hunting internet-exposed Windmill instances to read sensitive local files, bypass environment access boundaries, and exfiltrate production secrets, database connection strings, and cloud credentials without requiring any valid user credentials or session tokens.
Deep-Dive Technical Analysis
CVE-2026-29059 stems from improper input sanitization within the Windmill backend HTTP API handler. The vulnerability sequence is detailed below:
* Flawed Log Request Handler: The vulnerability specifically targets the /api/w/{workspace}/jobs_u/get_log_file/{filename} API endpoint. When servicing requests for job execution log files, the application accepts a user-controlled {filename} string parameter.
* Path Traversal Primitive: The backend code directly concatenates the raw {filename} input into a local file path string on the host filesystem without filtering or stripping relative directory sequences.
* Arbitrary File Read: Unauthenticated remote attackers submit HTTP GET requests incorporating string sequences like ../../../../etc/passwd or ../../../../wscript/.env. Because the parameter is concatenated directly, the file system resolves the path outside the designated log directory, returning raw, sensitive system files—including environment variable configurations, database connection strings, private API keys, and cryptographic encryption keys—directly in the HTTP response body.
Industry Impact and Mitigation Strategies
Because Windmill serves as a central orchestrator executing high-privilege scripts, internal workflows, and infrastructure automations, a compromise of its underlying environment exposes an organization's entire DevOps ecosystem.
Critical Vulnerability Data
Attribute
Detail
CVE Identifier
CVE-2026-29059
CVSS Severity
7.5 (High)
Vulnerability Type
Unauthenticated Path Traversal
Status
Active In-The-Wild Exploitation
Affected Software
Windmill (Self-managed instances)
Recommended Remediation Steps
1. Immediate Upgrade to Fixed Releases: All organizations hosting self-managed Windmill server deployments must immediately upgrade to Windmill version 1.418.0 or later, which enforces strict path canonicalization and validates that requested log files remain strictly within the designated log sandbox.
2. Secret Rotation: If an exposed Windmill instance was accessible on the public internet during the vulnerability window, assume all environment variables, database passwords, OAuth tokens, and SSH keys stored within Windmill workspaces have been compromised and require immediate revocation and rotation.
3. Perimeter Access Control: Enforce strict firewall, VPN, or IP-whitelisting rules ensuring that developer platform management interfaces (such as Windmill, Airflow, and Jenkins) are never directly exposed to the public internet without an inline authentication proxy or SSO gateway.
References:
* Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
* Published Advisories - TrendAI Zero Day Initiative