🟠 High | Source: The Hacker News
A high-severity path traversal vulnerability (CVE-2026-29059) in the open-source developer platform Windmill is being actively exploited in the wild, allowing unauthenticated attackers to read arbitrary files from the server. The flaw exists in the ‘get_log_file’ API endpoint, where unsanitised user input is concatenated directly into a file path. This means sensitive server files — including credentials, configuration, and secrets — could be exposed without any login required.
Security Architect’s Take: If you are running a self-hosted Windmill instance, patch to the latest version immediately and audit access logs for unexpected requests to ‘/api/w/{workspace}/jobs_u/get_log_file/’ — given active exploitation, treat any unpatched instance as potentially compromised. If Windmill is exposed to the internet, consider placing it behind a VPN or IP allowlist until the patch is confirmed applied.
Original advisory: Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication