Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
A high-profile security flaw affecting the developer’s open source platform Windmill has come under active exploitation in the wild, per VulnCheck.
The vulnerability in question CVE-2026-29059 (CVSS score: 7.5), an unauthorized path termination condition affecting the Windmill endpoint “get_log_file” (“/api/w/{workspace}/jobs_u/get_log_file/{filename}”).
“The filename parameter is appended to the file path without sanity, allowing an attacker to read conflicting files on the server using the ../ sequence,” according to an advisory published by Windmill in March 2026.
“The primary sensitive value exposed by this vulnerability is the SUPERADMIN_SECRET environment variable, which is readable via /proc/1/environ. If set, this secret can be used as a bearer token to authenticate as superadmin and execute arbitrary code through the job preview API.”
However, it is important to note that SUPERADMIN_SECRET is not set by default, and in standalone Windmill instances without SUPERADMIN_SECRET configuration, the impact of the vulnerability is limited to inadvertent file reading. The issue has been addressed in Windmill 1.603.3, released in January 2026, by adding sanitization checks to the filename parameter to prevent directory traversal.
According to VulnCheck, whose security researcher Valentin Lobstein is credited with finding and reporting the bug, the exploit attempts are targeting Windmill’s “get_log_file” to extract sensitive information from the “/etc/passwd” file.
“We’ve seen exploits targeted at both Windmill’s direct endpoints and Nextcloud’s proxy approach,” Caitlin Condon, vice president of security research at VulnCheck, said in a post on LinkedIn.
The cybersecurity company said it has identified about 170 vulnerable systems exposed in 24 countries.
The disclosure comes as the US Cybersecurity and Infrastructure Security Agency (CISA) added four security flaws to its catalog known as Known Exploited Vulnerabilities (KEV), including two WordPress bugs tracked as wp2shell (CVE-2026-60137 and CVE-2026-63030), and a DD overflow based on WW. (CVE-2021-27137) and an unconfirmed remote code execution issue in Langflow (CVE-2026-0770).
“wp2shell is one of the most important WordPress Core security developments in recent years,” said Wordfence. “The combination of unauthorized access, no plugin or theme requirement, a large global attack surface, a path to administrator access and code execution, and the public availability of evidence of exploitation make this series of vulnerabilities unusually serious.”
Attack data captured by a WordPress security firm shows that malicious actors are issuing requests to exploit the REST API problem for a bunch of request confusion and unauthorized SQL injection for code execution.
VulnCheck also said it has confirmed more than a dozen unique PoC exploits targeting WP2Shell since July 19, 2026. “Affected users should update to a stable version of WordPress as soon as possible, due to the high probability that various public and large-scale exploits will follow the high-profile disclosure,” added the profile disclosure.
As for CVE-2026-0770, Ryan Dewhurst of KEVIntel told Hacker News that the first wild attack attempts targeting this flaw were detected by its sensors on June 27, 2026, recording 137 exploit attempts from 46 different IP addresses associated with 17 countries since then.
More than 75 attempts, comprising more than half of the activity, originated from 20 attackers’ IP addresses during the last seven days. Recognized payloads include base command execution testing, attempts to extract the contents of “/etc/passwd” or access AWS credentials, environment variable collection, malware downloads using wget or curl, and using a shell script to install second-tier payloads.
“The work is not limited to risk assessment,” Dewhurst said. “While most of it involves commands like id, whoami and reading /etc/passwd, we’ve also seen payloads trying to download malware and get environment variables, AWS credentials and container metadata.”
Federal Civilian Executive Branch (FCEB) agencies are advised to correct the identified errors by July 24, 2026.
