A critical security vulnerability in the open-source developer platform Windmill has been actively exploited, according to VulnCheck. Identified as CVE-2026-29059, this flaw has a CVSS score of 7.5 and involves unauthorized path traversal affecting Windmill’s ‘get_log_file’ endpoint.
Details of the Vulnerability
The issue stems from the unsanitized concatenation of the filename parameter into a file path, enabling attackers to read server files using ../ sequences. Windmill’s advisory from March 2026 highlights the exposure of sensitive information, including the SUPERADMIN_SECRET environment variable, which can be exploited to gain superadmin access and execute arbitrary code.
It’s important to note that by default, the SUPERADMIN_SECRET is not set, limiting the flaw’s impact to unauthorized file access in standalone Windmill instances. The vulnerability was mitigated in Windmill version 1.603.3, released in January 2026, which included filename sanitization to block directory traversal attacks.
Exploitation Attempts and Impact
VulnCheck’s research, led by Valentin Lobstein, documented exploitation attempts targeting the ‘get_log_file’ endpoint to extract data from the ‘/etc/passwd’ file. Caitlin Condon, VulnCheck’s Vice President of Security Research, noted attacks directed at both Windmill endpoints and Nextcloud proxy paths.
Approximately 170 systems in 24 countries were identified as vulnerable. This revelation coincides with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) adding several security flaws, including this one, to its Known Exploited Vulnerabilities catalog.
Broader Cybersecurity Concerns
In addition to the Windmill flaw, CISA’s catalog included significant WordPress vulnerabilities, such as wp2shell, and a stack-based buffer overflow in DD-WRT. The WordPress issues, notable for their lack of plugin or theme requirements and broad attack surface, present a serious security challenge.
KEVIntel reported extensive exploitation attempts for CVE-2026-0770, with 137 attempts from 46 IP addresses across 17 countries. These efforts, involving both basic commands and more complex payloads, highlight an ongoing threat landscape.
Federal agencies have been urged to address these vulnerabilities by July 24, 2026, to prevent further exploitation.
The ongoing exploitation of these vulnerabilities underscores the importance of prompt security updates and proactive measures to safeguard systems against unauthorized access and data breaches.
