Windmill CVE-2026-29059 turns log access into a secrets problem

Attackers are now exploiting CVE-2026-29059, a Windmill path traversal flaw that lets unauthenticated users read arbitrary files from vulnerable self-hosted deployments. The immediate exploit activity reported this week is simple: requests against Windmill's get_log_file endpoint are being used to retrieve files such as /etc/passwd.

The larger risk is not the Linux account list itself. Windmill is a workflow and internal application platform. In many organizations, platforms like this sit between databases, cloud services, source repositories, SaaS APIs, and background jobs. If an attacker can read files available to the Windmill process, the incident can become a credential theft and secrets exposure problem very quickly.

Windmill fixed the issue in version 1.603.3, and the advisory has been public since March 2026. What changed now is exploitation pressure. Field Effect and The Hacker News reported active exploitation on July 22 and July 23, citing VulnCheck visibility into internet-exposed Windmill targets. That makes this a useful reminder: old public vulnerability disclosures can still become urgent when exploit traffic starts to scale.

What happened

Windmill is an open-source platform for building internal tools, APIs, workflows, background jobs, and user interfaces. The vulnerable endpoint is:

/api/w/{workspace}/jobs_u/get_log_file/{filename}

According to Windmill's GitHub security advisory, the filename parameter was joined into a file path without sufficient sanitization. An attacker could use directory traversal sequences to request files outside the intended log directory.

The flaw is tracked as CVE-2026-29059 and affects Windmill versions before 1.603.3. OpenCVE records CVSS 3.1 score 7.5 with network attack vector, low attack complexity, no privileges required, no user interaction, and high confidentiality impact. The CVE is not listed in CISA KEV at the time of writing, but CISA ADP enrichment records public proof-of-concept exploitation, automatable attack conditions, and partial technical impact.

The public advisory was published in March. The operational shift came in July, when public reporting said VulnCheck observed exploitation attempts aimed at the vulnerable file retrieval endpoint. The Hacker News reported that VulnCheck saw about 170 vulnerable systems exposed across 24 countries.

Why this matters

Path traversal bugs are sometimes treated as narrow information disclosure issues. That can be misleading in a workflow platform.

Windmill can hold or reach:

• environment variables
• database connection strings
• cloud credentials
• API keys
• authentication tokens
• job output and logs
• source code fragments
• internal hostnames and service paths

If those values are readable by the Windmill service account, an attacker may be able to pull enough material to pivot into downstream systems. That is why defenders should treat this as an incident response trigger for exposed or outdated deployments, not only as a routine upgrade item.

Field Effect's analysis makes the same practical point: the impact depends on deployment context and what the Windmill process can access. For standalone Windmill, the bug may be "only" arbitrary file read. In real environments, arbitrary file read can still mean application secrets, integration tokens, and cloud access material.

The SUPERADMIN_SECRET edge

Windmill's advisory calls out a specific high-risk case: the SUPERADMIN_SECRET environment variable.

When configured, this secret can be used as a bearer token to authenticate as a Windmill super administrator. Windmill says the variable is not set by default and is rarely used in standard standalone deployments. But if it is present and readable through /proc/1/environ, the path traversal flaw can become a path from unauthenticated file read to privileged application access and possible remote code execution through job preview functionality.

That makes the first triage question very concrete:

• Is this Windmill instance self-hosted?
• Is it internet-facing?
• Is it older than 1.603.3?
• Does it set SUPERADMIN_SECRET?
• Which files and secrets are readable by the Windmill process?
• Which downstream systems trust credentials stored near Windmill?

The answer determines whether the event is a simple patch, a secrets rotation exercise, or a broader compromise assessment.

Why Nextcloud Flow raises the stakes

The highest-risk scenario described in the advisory involves Windmill embedded inside Nextcloud Flow.

Windmill's advisory says SUPERADMIN_SECRET is systematically present when Windmill is embedded within Nextcloud Flow. It also notes that admin credentials are stored in a predictable configuration file path in that setup. Valentin Lobstein's research describes an attack chain where the Windmill path traversal issue can be used in the Flow architecture to move from file disclosure toward full compromise of the workflow environment.

For defenders, the lesson is not limited to Nextcloud. Embedded components often inherit different assumptions than the original standalone product. A secret that is rare in one deployment model may become normal in another. A patch that is available upstream may lag in a bundled integration. A "developer workflow" feature may end up reachable through a collaboration platform that security teams inventory differently.

That is exactly where exposure management matters. Teams need to know not only whether they run Windmill directly, but also whether another platform embeds it.

What defenders should do now

Start with asset discovery. Search for self-hosted Windmill and Nextcloud Flow deployments, especially where reverse proxies, public ingress rules, or partner access paths make them reachable from the internet.

Then prioritize:

• upgrade Windmill to 1.603.3 or later
• verify that embedded or bundled deployments have also moved to a fixed Windmill version
• restrict external access to the get_log_file endpoint if immediate upgrade is delayed
• place self-hosted workflow platforms behind authentication and network controls
• review web, proxy, and application logs for requests containing ../, encoded traversal patterns, /etc/passwd, /proc/1/environ, or suspicious configuration-file paths
• determine whether SUPERADMIN_SECRET is configured
• identify credentials, tokens, and secrets readable by the Windmill process
• rotate exposed credentials where unauthorized file access is suspected
• review downstream cloud, SaaS, database, and source-control activity for suspicious use of those credentials

Do not stop at checking the Windmill version if exploitation is plausible. If an attacker read environment variables or configuration files before the patch, updating the binary does not invalidate what they already copied.

Detection ideas

Look for suspicious requests to the log retrieval endpoint, including plain and encoded traversal attempts.

Useful patterns include:

/api/w/*/jobs_u/get_log_file/
../
..%2f
%2e%2e%2f
/etc/passwd
/proc/1/environ
windmill_users_config.json

On hosts, review access to environment files, application configuration files, database configuration, mounted secret locations, and job logs around the first suspicious web request.

Security teams should also look beyond the Windmill process. If tokens may have leaked, hunt for new API calls, unusual source-control access, cloud control-plane actions, suspicious database logins, or new workflow/job activity created after the suspected read.

Executive takeaway

CVE-2026-29059 is a good example of why file-read vulnerabilities in automation platforms deserve careful triage. The bug may begin as path traversal against a log endpoint, but the business impact depends on what the workflow platform can see.

For leadership, the clean message is:

• patch exposed Windmill deployments now
• treat Nextcloud Flow integrations as higher risk
• verify whether sensitive environment variables or configuration files were readable
• rotate credentials if unauthorized file access is suspected
• reduce internet exposure for workflow and orchestration platforms

The goal is not only to remove the vulnerable endpoint. It is to prove that the automation layer did not leak the credentials that hold the rest of the environment together.

What is CVE-2026-29059?

CVE-2026-29059 is an unauthenticated path traversal vulnerability in Windmill's get_log_file endpoint that can allow attackers to read arbitrary files from vulnerable servers.

Which versions are affected?

Windmill versions before 1.603.3 are affected. Windmill fixed the issue in version 1.603.3.

Is CVE-2026-29059 being exploited?

Yes. Public reporting on July 22 and July 23, 2026 says researchers observed active exploitation against internet-exposed Windmill deployments.

Is this in CISA KEV?

OpenCVE showed the vulnerability was not in CISA KEV at the time of writing, but CISA ADP enrichment records proof-of-concept availability, automatable exploitation, and partial technical impact.

Why is SUPERADMIN_SECRET important?

If SUPERADMIN_SECRET is configured and exposed through readable environment data, an attacker may be able to authenticate as a Windmill super administrator and move toward arbitrary code execution.

What should defenders do first?

Upgrade to Windmill 1.603.3 or later, check internet exposure, review logs for traversal attempts, determine whether secrets were readable, and rotate credentials if unauthorized access is suspected.

References

1. SUPERADMIN_SECRET can be accessed publicly on versions < 1.603.3 using RCE
2. CVE-2026-29059 vulnerability details
3. Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
4. Active exploitation of Windmill vulnerability
5. Windfall: From Path Traversal to RCE in Nextcloud Flow and Windmill