Unpatched Windmill Flaw Lets Hackers Steal Server Files Without a Login

Robert Moore · 2026-07-22

If you're using the open-source developer platform Windmill, there's a security issue you need to know about right now. A serious vulnerability is being actively exploited in the wild, and it doesn't even require an attacker to log in. Security researchers at VulnCheck first sounded the alarm. The flaw, tracked as CVE-2026-29059, carries a CVSS score of 7.5, which puts it in the high-severity category. That's not something you want to ignore. ### What's Actually Going On? The problem lives in a specific endpoint: `/api/w/{workspace}/jobs_u/get_log_file/{filename}`. It's a path traversal vulnerability. In plain English, that means an attacker can manipulate the filename parameter to wander outside the intended directory and read arbitrary files from the server. Think of it like this: you have a locked filing cabinet, but someone figured out they can reach around the back and pull out documents from any drawer without ever touching the lock. That's essentially what this bug allows. Here's what makes it especially dangerous: - No authentication required. Anyone who can reach the endpoint can exploit it. - It's already being used in real attacks, not just theoretical proof-of-concept code. - The vulnerability affects how Windmill handles log file requests, a feature that seems innocent enough on the surface. ### Why You Should Care If you're running a Windmill instance, this isn't just a "patch when you get around to it" kind of thing. Attackers are actively scanning for vulnerable servers. Once they find one, they can pull sensitive data like configuration files, environment variables, or even source code. I've seen this pattern before. A seemingly minor endpoint oversight turns into a gateway for data breaches. And because it's unauthenticated, there's no barrier to entry for attackers. They don't need to steal credentials or guess passwords. They just need to know the endpoint exists. ### What You Can Do Right Now First, check if your Windmill installation is up to date. The developers have likely released a patch, so updating should be your top priority. If you can't patch immediately, consider restricting access to the affected endpoint through a web application firewall or reverse proxy. Second, audit your logs for any unusual activity. Look for requests to the `/api/w/{workspace}/jobs_u/get_log_file/` path that contain suspicious filename patterns, like `../` or encoded traversal sequences. Third, assume compromise if you've been running an unpatched version. Change any secrets or keys that might have been exposed. Rotate API tokens, database credentials, and any other sensitive data stored on that server. ### The Bigger Picture This isn't just a Windmill problem. It's a reminder that every exposed endpoint is a potential attack vector. The convenience of unauthenticated access often comes with hidden costs. And in this case, the cost could be your data. Path traversal vulnerabilities have been around for decades, yet they keep showing up in modern applications. Why? Because developers often trust user input without sanitizing it properly. A simple validation check on the filename parameter could have prevented this entire issue. If you're a developer, let this be a lesson: never trust input from users, even for seemingly harmless features like fetching log files. Always validate, sanitize, and restrict file paths. ### Final Thoughts Security isn't a one-time setup. It's an ongoing practice. The Windmill flaw is being exploited right now, and the window to protect yourself is closing fast. Don't wait for a breach to take action. Check your systems, apply the patch, and stay vigilant. The hackers are counting on you to be slow. Prove them wrong.