About 170 Windmill instances exposed across 24 countries have been identified as vulnerable to an unauthenticated path traversal bug, according to VulnCheck's analysis of active exploitation.
CVE-2026-29059 and Windmill's get_log_file endpoint
The flaw, tracked as CVE-2026-29059 (CVSS score: 7.5), targets Windmill's "get_log_file" endpoint at "/api/w/{{workspace}}/jobs_u/get_log_file/{{filename}}". Windmill's advisory published in March 2026 describes the technical root: "The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences." Windmill released a fix in January 2026 — Windmill 1.603.3 — that adds sanitization checks to the filename parameter to prevent directory traversal.
What attackers have been trying to read — and why
VulnCheck reports that exploitation attempts have focused on extracting sensitive files such as "/etc/passwd" from vulnerable Windmill endpoints. The vendor advisory highlights a single configuration detail that sharply raises the stakes when set: "The primary sensitive value exposed by this vulnerability is the SUPERADMIN_SECRET environment variable, readable via /proc/1/environ. When set, this secret can be used as a Bearer token to authenticate as a superadmin and execute arbitrary code through the job preview API." The advisory also notes that SUPERADMIN_SECRET "is not set by default," and that in standalone Windmill instances without that environment variable configured the impact is limited to arbitrary file read.
VulnCheck's discovery, observed vectors, and scale
VulnCheck credited security researcher Valentin Lobstein with discovering and reporting the flaw. Caitlin Condon, vice president of security research at VulnCheck, said that the company "observed exploits aimed at both direct Windmill endpoints and the Nextcloud proxy path." In total, VulnCheck identified about 170 vulnerable systems exposed across 24 countries, and reported active exploitation in the wild.
Related additions to CISA's KEV catalog and parallel exploit activity
The disclosure arrives alongside additional listings in the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities (KEV) catalog. CISA added four flaws, including two WordPress bugs tracked as wp2shell (CVE-2026-60137 and CVE-2026-63030), a stack-based buffer overflow in DD-WRT (CVE-2021-27137), and an unauthenticated remote code execution issue in Langflow (CVE-2026-0770).
Security vendors described active and brazen attempts to weaponize these other listed flaws. Wordfence called wp2shell "one of the most significant WordPress Core security events in recent years," and explained that the vulnerability chain combines "unauthenticated reachability, no plugin or theme requirement, a large global attack surface, a path to administrator access and code execution, as well as public proof-of-concept exploit availability." Wordfence's attack telemetry shows threat actors issuing requests that chain a REST API batch request route-confusion issue with an unauthenticated SQL injection to achieve code execution.
On Langflow's CVE-2026-0770, KEVIntel's Ryan Dewhurst told The Hacker News that his sensors first detected exploitation attempts on June 27, 2026. Dewhurst recorded 137 exploitation attempts from 46 unique attacker IP addresses associated with 17 countries, and noted that no less than 75 attempts — more than half of the activity — came from 20 attacker IP addresses during the last seven days of his reporting period.
Dewhurst summarized observed payloads: "base command execution checks, attempts to extract the contents of '/etc/passwd' or access AWS credentials, environment variable collection, malware downloads using wget or curl, and shell script execution to install second-stage payloads." He emphasized: "The activity is not limited to vulnerability checks," noting attempts aimed at credential and environment-variable harvesting as well as follow-on malware delivery.
What this means for technologists, federal agencies, and adversaries
- Technologists and security teams: Confirm Windmill instances are running a patched release (Windmill 1.603.3 or later) or have manual sanitization controls in place; check whether SUPERADMIN_SECRET is set and, if so, rotate or revoke it and review logs for signs of abuse. Watch for requests targeting "/api/w/{{workspace}}/jobs_u/get_log_file/{{filename}}" and proxy paths through Nextcloud.
- Federal Civilian Executive Branch (FCEB) agencies and policymakers: Remediation guidance is time-bound — FCEB agencies are advised to remediate identified flaws by July 24, 2026. Agencies should prioritize instances that expose management or preview APIs and those that may have the SUPERADMIN_SECRET environment variable configured.
- Adversaries and threat actors: Public exploit activity against Windmill and the other KEV-listed flaws shows a pattern of opportunistic scanning, directory traversal and command-execution probes, plus follow-on attempts to harvest environment variables, cloud credentials and to download additional payloads.
The immediate, verifiable vector is simple: an unsanitized filename parameter concatenated into a path. The consequence is bounded or severe depending on one environment variable. Windmill's January patch removes the basic traversal primitive; the remaining questions are operational: how many of the roughly 170 exposed instances remain unpatched, whether any had SUPERADMIN_SECRET set and harvested, and whether the July 24, 2026 remediation deadline for FCEB agencies is met.
