VulnCheck identified about 170 vulnerable systems across 24 countries, all running the open‑source developer platform Windmill. The flaw lets attackers read arbitrary files without authentication, and it’s being weaponized in the wild.
Key Takeaways
- CVE‑2026‑29059 scores 7.5 on the CVSS scale.
- Exploits target the
/api/w/{workspace}/jobs_u/get_log_file/{filename}endpoint. - SUPERADMIN_SECRET, if set, can be turned into a bearer token for full admin access.
- Windmill 1.603.3, released January 2026, patches the issue.
- U.S. agencies must remediate by July 24, 2026.
Windmill vulnerability details and severity
According to the advisory published by Windmill in March 2026, the filename parameter is concatenated into a file path without any sanitization. That lax handling lets attackers slip “../” sequences into the request and climb the directory tree. The endpoint in question – /api/w/{workspace}/jobs_u/get_log_file/{filename} – was designed to fetch log files for job previews, but now it serves as a backdoor for reading any file the server can access.
That’s a classic path‑traversal bug, but the CVSS score of 7.5 reflects its impact. It’s not just about reading /etc/passwd; the real prize is the SUPERADMIN_SECRET environment variable, which lives in /proc/1/environ. If that secret is set, an attacker can craft a bearer token and masquerade as a superadmin, opening the door to arbitrary code execution via the job preview API.
Technical breakdown
- Endpoint:
/api/w/{workspace}/jobs_u/get_log_file/{filename} - Vulnerability: Unauthenticated directory traversal via unsanitized filename.
- Primary secret exposed: SUPERADMIN_SECRET (readable via
/proc/1/environ). - Potential follow‑up: Bearer token creation → code execution.
But there’s a catch. Windmill doesn’t set SUPERADMIN_SECRET by default. Standalone instances that haven’t configured that variable are limited to arbitrary file reads. Still, reading /etc/passwd or other configuration files can aid lateral movement, especially in containerized deployments.
Exploitation in the wild
VulnCheck’s researcher Valentin Lobstein discovered the flaw and reported it to Windmill. Since then, the company’s security team has seen active exploitation aimed at extracting /etc/passwd and probing the Nextcloud proxy path. Caitlin Condon, vice president of security research at VulnCheck, posted on LinkedIn:
“We’ve observed exploits aimed at both direct Windmill endpoints and the Nextcloud proxy path,”
That aligns with the 170 systems that VulnCheck flagged. The attackers are not just testing the vulnerability; they’re pulling data out of the server, likely to enumerate users and hunt for further footholds.
In a separate observation, KEVIntel’s Ryan Dewhurst told The Hacker News that their sensors logged 137 exploitation attempts on June 27, 2026, from 46 unique IPs spanning 17 countries. More than half of those attempts – 75 in total – came from just 20 IP addresses in the last week of June.
“The activity is not limited to vulnerability checks,” Dewhurst said. “While much of it involved commands such as id, whoami and reading /etc/passwd, we also observed payloads attempting to download malware and obtain environment variables, AWS credentials and container metadata.”
Those payloads include classic checks like id and whoami, but also attempts to fetch cloud credentials and run wget or curl to pull second‑stage malware. The pattern shows a clear intent: turn a read‑only flaw into a foothold for broader compromise.
Patch rollout and remediation timeline
Windmill addressed the issue in version 1.603.3, released January 2026. The fix adds sanitization checks to the filename parameter, effectively blocking “../” sequences and rejecting any path that attempts to escape the designated log directory. Windmill’s advisory urges all users to upgrade immediately.
For organizations running Windmill in production, the remediation window is tight. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) listed the flaw in its Known Exploited Vulnerabilities (KEV) catalog, and Federal Civilian Executive Branch agencies have been instructed to patch by July 24, 2026. That deadline underscores the seriousness CISA places on this vector, especially given the cross‑region exploitation activity.
Context within the broader KEV surge
The same CISA update also added four other high‑profile bugs: two WordPress core issues (wp2shell, CVE‑2026‑60137 and CVE‑2026‑63030), a stack‑based buffer overflow in DD‑WRT (CVE‑2021‑27137), and an unauthenticated RCE in Langflow (CVE‑2026‑0770). Wordfence called wp2shell “one of the most significant WordPress Core security events in recent years,” noting its unauthenticated reachability and the fact that no plugin or theme is required for exploitation.
While Windmill isn’t as ubiquitous as WordPress, the fact that it landed on the KEV list signals a shift: open‑source developer tools are now prime targets for nation‑state and criminal actors alike. The exploitation of CVE‑2026‑0770, tracked by KEVIntel, showed similar patterns—attackers probing for /etc/passwd, AWS keys, and container metadata. The convergence of these exploits suggests a coordinated push to harvest credentials from development environments.
Historical Context
Path‑traversal bugs have been a staple of web‑application security for decades. Early examples often involved simple concatenations of user input into file system calls, allowing attackers to climb out of a sandboxed directory. Over time, many projects added defensive libraries that strip dangerous sequences, yet some codebases still rely on manual checks.
Windmill’s own advisory notes that the flaw stems from a missing sanitization step. That mirrors the issue seen in the DD‑WRT buffer overflow, where a low‑level oversight opened a remote code path. Both incidents illustrate how a single unchecked string can cascade into full system compromise.
Open‑source platforms tend to evolve quickly, and community contributors sometimes prioritize feature delivery over exhaustive input validation. The wind‑up is that attackers keep searching for those gaps, especially when a tool sits at the heart of a CI/CD pipeline.
Developers familiar with earlier traversal exploits will recognize the pattern. The same technique—injecting “../” sequences—appears across many languages and frameworks. The persistence of this attack vector highlights the need for built‑in safeguards rather than relying on ad‑hoc checks.
Technical Architecture Overview
The vulnerable endpoint lives under the /api/w/ namespace, which handles workspace‑scoped operations. When a request arrives, the server builds a file path by appending the supplied filename value to a predefined logs directory. No whitelist or canonicalization occurs before the operating system resolves the path.
Because the server runs with permissions sufficient to read the logs directory, it can also read any sibling file that the process can access. In containerized deployments, that often includes the host’s /proc filesystem, making /proc/1/environ reachable. The environment variable stored there becomes the linchpin for privilege escalation.
Once an attacker extracts the SUPERADMIN_SECRET, they can craft an HTTP Authorization: Bearer header that the API accepts as proof of superadmin status. Subsequent API calls can then trigger job execution with arbitrary payloads, effectively giving the attacker code‑execution rights inside the Windmill instance.
Even without the secret, the ability to read arbitrary files remains dangerous. Configuration files often contain database connection strings, API keys, or internal service URLs. An adversary can stitch together these clues to map the broader network, enabling for multi‑stage attacks.
What This Means For You
If you run Windmill, upgrade to 1.603.3 right now. The patch is the only reliable defense against the directory‑traversal path. Even if you haven’t set SUPERADMIN_SECRET, the ability to read arbitrary files can expose configuration secrets, internal APIs, or even source code that could be weaponized elsewhere.
Beyond the immediate fix, audit your environment for any leftover /proc/1/environ copies or other environment variables that might contain high‑privilege secrets. Restrict network access to the /api/w/.../get_log_file endpoint, and consider rate‑limiting or IP‑based allowlists until you’re sure no lingering attackers remain.
Looking ahead, the Windmill case is a reminder that even well‑intentioned open‑source tools can become attack surfaces when they expose internal paths without validation. As supply‑chain threats keep evolving, developers should treat every external endpoint as a potential entry point and enforce strict input sanitization.
Scenario one: a startup uses Windmill to orchestrate nightly data pipelines. A breach of the log endpoint could reveal database credentials stored in environment files, letting an attacker siphon sensitive customer data.
Scenario two: an agency deploys Windmill behind a VPN but leaves the API exposed to the internet for remote debugging. An unauthenticated actor could probe the endpoint, harvest system files, and later pivot into other internal services.
Scenario three: a SaaS provider bundles Windmill into a multi‑tenant offering. If one tenant’s instance is compromised, the attacker might read tenant‑specific logs and extract API keys that give access to other customer resources.
Each case shares a common thread: the need for defense‑in‑depth. Patch quickly, monitor logs for unusual filename patterns, and isolate the service where possible.
Key Questions Remaining
- Will future KEV additions keep surfacing similar developer‑tool flaws, or will the focus shift back to more traditional web applications?
- How many undisclosed Windmill deployments still run vulnerable versions, and what detection mechanisms can surface them without exposing further risk?
- What additional hardening steps can organizations take to protect the
/procnamespace from accidental exposure in container environments?
Answers will emerge as the community digests the advisory and as CISA releases follow‑up guidance. In the meantime, the safest path stays clear: patch, audit, and limit exposure.
Sources: The Hacker News, original report
