Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

The discovery of a critical security vulnerability in the open-source developer platform Windmill has triggered immediate alerts across the cybersecurity community following confirmation of active exploitation in the wild. Researchers at VulnCheck have identified that threat actors are already leveraging this flaw to extract sensitive data from unpatched servers, turning a development tool into a potential gateway for severe data exfiltration. This incident highlights a recurring and dangerous pattern where functionalities designed to streamline operations inadvertently expose organizations to unauthorized access, requiring urgent attention from DevOps and security teams alike.

At the center of this threat is CVE-2026-29059, a vulnerability that has been assigned a high-severity CVSS score of 7.5. The flaw exists within the platform's "get_log_file" endpoint and is classified as an unauthenticated path traversal vulnerability. By manipulating the specific API route used to retrieve job logs, attackers can trick the server into revealing files from the directory structure. The technical mechanism behind this issue involves the insecure concatenation of the filename parameter directly into the file path string without proper sanitization. Consequently, malicious actors can inject directory traversal sequences, effectively bypassing the application's intended logic to read arbitrary files on the host system. What makes this situation particularly volatile is that the attack requires no authentication, meaning an attacker does not need valid credentials to initiate the file theft.

For security teams, the implications of this vulnerability are severe and extend far beyond simple data access. The ability to read arbitrary files on a server often serves as a stepping stone to total system compromise. Attackers could potentially harvest source code, API keys, database credentials, or configuration files containing secrets that are hardcoded within the infrastructure. Since active exploitation has already been confirmed, organizations cannot rely on passive defense strategies. Security leaders must assume that any internet-facing Windmill instance is currently being targeted or scanned. Teams should immediately prioritize patching affected systems and conduct forensic analysis on logs to determine if any sensitive files have been accessed. It is crucial to search for suspicious patterns targeting the vulnerable endpoint and to review any file access logs that fall outside normal operational baselines.

Ultimately, the active exploitation of CVE-2026-29059 serves as a stark reminder of the persistent risks associated with path traversal vulnerabilities in modern development tools. The ease with which attackers can exploit this flaw to access sensitive server files without authentication significantly lowers the barrier to entry for potential cybercriminals. Security professionals must enforce immediate patching cycles for critical internet-facing infrastructure and maintain rigorous vigilance regarding input validation in their custom applications. This event reinforces the necessity of treating developer platforms with the same defensive rigor as production environments, as they often hold the keys to the kingdom in the form of sensitive intellectual property and credentials.