New Windmill Flaw Lets Hackers Steal Server Files Without a Login

Emily Davis · 2026-07-22

A serious security hole in the open-source developer platform Windmill is now being actively exploited in the wild, according to a report from VulnCheck. The vulnerability, tracked as CVE-2026-29059, carries a CVSS score of 7.5, which puts it firmly in the high-severity category. At its core, this is an unauthenticated path traversal issue that affects Windmill's "get_log_file" endpoint, specifically the path: `/api/w/{workspace}/jobs_u/get_log_file/{filename}`. ### How the Attack Works The flaw lies in how the filename parameter is handled. Instead of properly sanitizing user input, the system concatenates the filename directly into the file path. This allows an attacker to use special characters like `../` to traverse up the directory tree and access files that should be off-limits. Think of it like this: if you had a locked filing cabinet, but someone could reach around the side and grab documents from the drawer next to it without ever needing a key. That's what this bug does, but for server files. ### What Makes This Dangerous Here's why this vulnerability is particularly concerning: - **No authentication required** – An attacker doesn't need a username or password to exploit it. They just need to send a specially crafted request. - **Active exploitation** – This isn't just a theoretical risk. Security researchers have confirmed that attackers are already using this flaw in the wild. - **Broad access** – Depending on the server configuration, an attacker could read configuration files, source code, database credentials, or other sensitive data. ### Who Should Be Concerned If you're running a self-hosted version of Windmill for your development workflows, this is a critical issue to address. The platform is popular among teams that need to automate tasks, run scripts, or manage workflows, so any compromise could expose proprietary code or internal infrastructure. ### Steps to Protect Yourself While waiting for an official patch from the Windmill team, here are some immediate actions you can take: - **Update immediately** – Check for any security patches or updates from Windmill. If a fix is available, apply it right away. - **Restrict network access** – Limit access to the Windmill API to trusted IP addresses only. Use a firewall or VPN to keep the endpoint from being exposed to the public internet. - **Monitor logs** – Look for unusual requests to the `/api/w/{workspace}/jobs_u/get_log_file/` endpoint, especially those containing directory traversal patterns like `../`. - **Review file permissions** – Ensure that sensitive files on your server have restricted read permissions, so even if an attacker gets through, they can't access critical data. ### The Bigger Picture This incident is a reminder that open-source software, while powerful and flexible, requires active maintenance and vigilance. Vulnerabilities like CVE-2026-29059 can pop up in any platform, and the window between discovery and exploitation is shrinking. If you're a developer or sysadmin using Windmill, now is the time to act. Don't wait for a breach to happen. Check your systems, apply updates, and tighten your security posture. Stay safe out there.