CVE-2026-29059: Windmill Path Traversal Actively Exploited

Exploitation confirmed. VulnCheck flagged active in-the-wild exploitation of CVE-2026-29059 — an unauthenticated path traversal in the open-source developer workflow platform Windmill — as of July 22, 2026. No credentials required to exploit. CISA KEV status: not yet listed as of publication.

The Vulnerability

The flaw lives in Windmill’s get_log_file API endpoint: /api/w/{workspace}/jobs_u/get_log_file/{filename}. According to VulnCheck’s disclosure, the filename parameter is concatenated directly into a server-side filesystem path without sanitization, enabling directory traversal. No authentication required.

CVSS score: 7.5 (High), per NVD.

Vulnerability class: unauthenticated path traversal. A well-understood attack class finding a new home in a developer workflow orchestration platform. Deployment surface is broad — Windmill is widely self-hosted by engineering and operations teams for internal tooling, script automation, and data pipelines.

Who Is at Risk

Any Windmill instance on an unpatched build that is reachable from the network. Self-hosted deployments exposed to the public internet are the immediate concern. Internal-only deployments on isolated networks face a lower but non-zero risk from threat actors already inside the perimeter.

What Attackers Can Read

Unauthenticated file read. Practical reach depends on what the Windmill process user can access on the host filesystem. That scope can include:

• Job execution logs
• Configuration files
• Secrets or API keys injected as environment variables
• Credential files accessible to the process

Confidence on observed attacker behavior: unconfirmed beyond VulnCheck’s active-exploitation finding. What they found, what they took — not yet public.

Timeline

• 2026-07-22: VulnCheck publishes findings and confirms active in-the-wild exploitation.
• 2026-07-22: The Hacker News covers the disclosure.
• CISA KEV: Not listed as of this article’s publication. Monitor CISA’s KEV catalog for updates. A path-traversal flaw with confirmed in-the-wild exploitation is exactly the profile that earns KEV inclusion — treat it as probable, not guaranteed.

What to Do

Patch is available. Pull the fixed version from Windmill’s GitHub releases and apply it now.

If immediate patching is not possible:

• Restrict network access to the Windmill instance — take it off the public internet until patched.
• Review API gateway, load balancer, or reverse-proxy logs for anomalous requests to the jobs_u/get_log_file path.
• Audit what files the Windmill process user can access on your host filesystem.
• Rotate any secrets, API keys, or credentials that could have been accessible to the Windmill process user.

Unconfirmed as of Publication — Treat Accordingly

• Specific versions affected versus fixed — consult release notes.
• Scale and scope of observed in-the-wild exploitation.
• Whether any attacks have been attributed to a specific threat actor or campaign.
• CISA KEV addition timing.

Sources

• The Hacker News, 2026-07-22: Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication — sourcing VulnCheck’s active exploitation finding.
• NVD: CVE-2026-29059 — CVSS 7.5 (High).

Confidence, consolidated: exploitation is confirmed per VulnCheck; CVSS 7.5 high confirmed per NVD; attacker TTPs and compromised targets unconfirmed; specific affected versions check release notes. Patch is out. Running past today is a decision, not bad luck.