Windmill Path Traversal Flaw Under Active Attack, VulnCheck Warns
CVE-2026-29059 lets unauthenticated attackers read files from servers running the open-source developer platform. Patch guidance and exploitation details below.
Key points
- VulnCheck has confirmed active in-the-wild exploitation of CVE-2026-29059, a path traversal flaw in the open-source developer platform Windmill, carrying a CVSS score of 7.5.
- The bug sits in Windmill's
get_log_fileAPI endpoint and requires no login to abuse. - Attackers can read arbitrary files from the server hosting Windmill, including logs and sensitive configuration data.
- Organisations running Windmill should update to a patched release immediately and review server logs for suspicious requests to
/api/w/{workspace}/jobs_u/get_log_file/.
A security flaw in Windmill, a popular open-source platform developers use to build and automate internal tools, is being actively exploited, according to threat intelligence firm VulnCheck. The vulnerability is tracked as CVE-2026-29059 and rated high severity, with a CVSS score of 7.5 out of 10. It's the kind of bug that turns a quiet Tuesday into a very long week.
What does the flaw actually let attackers do?
It lets them pull files off a server they should never be able to see. The bug lives in an API endpoint (a web address that software uses to talk to other software) called get_log_file, meant to return log files for jobs Windmill has run. It can be tricked into returning almost any file the Windmill process has permission to read.
Path traversal is the technique: the attacker feeds the endpoint a filename stuffed with ../ characters meaning "go up one folder". Chain enough of them together and the request walks clean out of the log directory into the broader file system. Because the endpoint doesn't check who's calling it, no credentials of any kind are required. Anyone who can reach the server over the network can try this.
As first reported by The Hacker News, VulnCheck has observed real attacks probing this exact endpoint. That moves CVE-2026-29059 from theoretical risk to something defenders should be acting on today.
What could an attacker steal?
Anything the Windmill service can read on disk. That typically means application logs, environment files holding database passwords, cloud access keys, and SSH keys used to reach other machines. A stolen credential from one Windmill box can become the foothold for a much wider intrusion.
No ransomware or data destruction has been reported here. The risk is quiet theft of secrets, followed by whatever the attacker does with them next.
Should you worry?
If your organisation self-hosts Windmill and exposes it to the internet or to a large internal network where an attacker may already have a foothold, yes. Windmill sits close to production systems and secrets by design: it's built to stitch APIs together, run scheduled jobs and touch live infrastructure.
Patching is step one. Step two is restricting network access to the Windmill UI and API so it isn't reachable from the public internet. Step three is searching web server and reverse proxy logs for requests to /api/w/*/jobs_u/get_log_file/ containing .. or URL-encoded variants like %2e%2e. Step four, and the one most teams skip: rotate every credential, token and key stored in files the Windmill process could read, on the assumption they may already be gone.
Path traversal flaws in developer platforms keep producing exactly this scenario. Our coverage of the Progress ShareFile zero-day on 14 July showed how quickly a similar file-read bug moves from disclosure to active attack. The pattern here is identical, which means the response window is short.
Ordinary users of services built on top of Windmill don't need to take direct action. That responsibility sits with the engineering teams running the platform. If a company that uses Windmill notifies you of a credential reset, follow their instructions promptly.
