Windmill Path Traversal Flaw Under Active Attack, VulnCheck Warns

Key points

• VulnCheck reported active in-the-wild exploitation of CVE-2026-29059, a path traversal flaw in the open-source developer platform Windmill, carrying a CVSS score of 7.5.
• The bug sits in Windmill's get_log_file API endpoint and requires no login to abuse.
• Attackers can read arbitrary files from the server hosting Windmill, including logs and potentially sensitive configuration data.
• Organisations running Windmill should update to a patched release immediately and review server logs for suspicious requests to /api/w/{workspace}/jobs_u/get_log_file/.

A security flaw in Windmill, a popular open-source platform that developers use to build and automate internal tools, is being actively exploited, according to threat intelligence firm VulnCheck. The vulnerability is tracked as CVE-2026-29059 and rated high severity, with a CVSS score of 7.5 out of 10.

In plain terms, the flaw lets an attacker on the internet read files from a Windmill server without ever logging in.

What does the flaw actually let attackers do?

It lets them pull files off the server that they should never be able to see. The bug lives in an API endpoint (a web address that software uses to talk to other software) called get_log_file. That endpoint is meant to return log files for jobs that Windmill has run. Instead, it can be tricked into returning almost any file the Windmill process has permission to read.

The technique is called path traversal. The attacker feeds the endpoint a filename that includes special characters (../) meaning "go up one folder". By chaining enough of these, the request walks out of the log directory and into other parts of the file system.

Because the endpoint does not check who is calling it, no username, password, or API key is needed. Anyone who can reach the Windmill server over the network can try it.

As first reported by The Hacker News, VulnCheck has observed real attacks probing this exact endpoint. That moves the bug from theoretical risk to something defenders need to act on this week, not next quarter.

What could an attacker steal?

Anything the Windmill service can read on disk. That often includes application logs, environment files with database passwords, cloud credentials, and SSH keys used to reach other machines. In a worst case, a stolen credential from one Windmill box becomes the foothold for a much wider intrusion.

There is no ransomware or data destruction reported here. The risk is quiet theft of secrets, followed by whatever the attacker chooses to do with those secrets later.

Who is affected?

Organisations that self-host Windmill and expose it to the internet, or to a large internal network where an attacker may already have a foothold. Windmill is used by engineering teams to build internal dashboards, run scheduled jobs, and stitch together APIs, so exposed instances often sit close to production systems and secrets.

Administrators should:

1. Update Windmill to the fixed release published by the maintainers.
2. Restrict network access to the Windmill UI and API so it is not reachable from the public internet.
3. Search web server and reverse proxy logs for requests to /api/w/*/jobs_u/get_log_file/ that contain .. or URL-encoded variants such as %2e%2e.
4. Rotate any credentials, tokens, or keys that were stored in files readable by the Windmill process, on the assumption they may already have been exfiltrated.

Ordinary users of services built on top of Windmill do not need to take direct action. The response sits with the engineering teams running the platform. If you are a customer of a company that uses Windmill and they notify you of a credential reset, follow their instructions promptly.