Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

What Changed

Attackers are exploiting CVE-2026-29059 (CVSS 7.5), an unauthenticated path traversal flaw in the Windmill developer platform. The bug sits in the get_log_file endpoint (/api/w/{workspace}/jobs_u/get_log_file/{filename}) and lets a remote attacker read arbitrary files from the server without logging in.

VulnCheck researcher Valentin Lobstein reported exploitation attempts that read /etc/passwd, including requests routed through the Nextcloud proxy path. VulnCheck counted roughly 170 vulnerable systems across 24 countries. CISA has added the flaw to the Known Exploited Vulnerabilities (KEV) catalog with a July 24 deadline for federal civilian agencies, in the same update as the wp2shell flaws (CVE-2026-60137 and CVE-2026-63030), DD-WRT CVE-2021-27137 and Langflow CVE-2026-0770.

Why This Is More Than A File-Read Bug

Arbitrary file read on an automation platform is a secrets problem. If an administrator has set SUPERADMIN_SECRET, the value can be read from /proc/1/environ, which turns a read-only bug into full administrative control. The variable is not set by default, so impact depends on how each instance was deployed.

The timeline is also worth noting: Windmill fixed the issue in version 1.603.3 in January 2026 and published its advisory in March. Instances still being hit in July are ones that missed a fix that has been available for about six months.

What To Verify First

• Confirm every Windmill instance, including self-hosted and embedded deployments, is on 1.603.3 or later.
• Check whether SUPERADMIN_SECRET or other secrets are passed as environment variables, and rotate them if the instance was exposed while unpatched.
• Search web and proxy logs for requests to get_log_file containing traversal sequences, including traffic arriving through Nextcloud integrations.
• Remove direct internet exposure for instances that do not need it.

What Teams May Be Underestimating

A small exposed population does not mean low attacker interest. KEV listing plus public exploitation means opportunistic scanning will continue, and any credential that sat in a readable file or environment block should be treated as potentially exposed.

Source Context

This item was rebuilt from the following primary sources and original reporting:

• The Hacker News: Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

Related In The Daily Brief

See this item in The 5-Minute Cyber Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].

Keep Reading

Explore more →

Metabase SQLi zero-day exploited in customer data-theft attacks

Metabase confirmed active exploitation of a critical unauthenticated SQL injection flaw that can hand a remote attacker administrator access to…

CISA warns of hackers exploiting Langflow, N-central, Apache Tomcat flaws

CISA is telling federal agencies to move within three days on actively exploited flaws in IBM Langflow, N-able N-central, and…

INC Ransomware Emerges as Dominant Actor Exploiting SonicWall SMA 1000 Flaws

Resecurity says INC Ransomware now leads exploitation of SonicWall SMA 1000 flaws CVE-2026-15409 and CVE-2026-15410, after zero-day use that stole…