Published July 23, 2026.

CVE-2026-29059 is an unauthenticated path-traversal flaw in the open-source Windmill developer platform that lets attackers read arbitrary files off the server — and it is under active exploitation, according to VulnCheck. Update to Windmill 1.603.3 or later now.

What happened. Attackers are actively exploiting CVE-2026-29059, an unauthenticated path-traversal vulnerability in Windmill, the open-source platform for internal APIs, background jobs, and workflows. The flawed endpoint — /api/w/{workspace}/jobs_u/get_log_file/{filename} — concatenates the filename parameter into a file path without sanitization, so ../ sequences let an attacker read any file the server can. VulnCheck reports in-the-wild exploitation aimed at /etc/passwd and, more damagingly, the SUPERADMIN_SECRET environment variable via /proc/1/environ, and identified roughly 170 exposed systems across 24 countries, hit both directly and through Nextcloud proxy paths. The fix shipped in Windmill 1.603.3.

How bad is CVE-2026-29059?

NVD rates it CVSS 6.9 (Medium, CVSS 4.0), CWE-22 path traversal — but the score understates it. It is unauthenticated, its EPSS score is in the 83.6th percentile, and it is already being exploited to steal the admin secret that unlocks the whole Windmill instance. When active exploitation and secret theft are in play, the "Medium" label is a floor, not a ceiling.

What can an attacker read?

What to do now.

• Upgrade to Windmill 1.603.3 or later immediately on every instance, including those behind reverse proxies like Nextcloud.

• Rotate SUPERADMIN_SECRET and any secrets reachable from the host — assume they were read if you were exposed and unpatched.

• Take exposed instances off the public internet and check access logs for requests to get_log_file containing ../ or /proc/1/environ.

Who's affected. Any organization running a Windmill instance older than 1.603.3, especially internet-exposed deployments and those fronted by a reverse proxy — VulnCheck already counts ~170 exposed hosts under attack.

Our read. The lesson is in the CVSS gap: a "Medium" 6.9 that, in the real world, hands an unauthenticated attacker the platform's superadmin secret. Severity scores rank the mechanism; exploitation ranks the outcome, and here the outcome is total instance compromise. This is the exposure window our KEV work keeps flagging — a public exploit plus internet-reachable instances means the clock started before most teams read the advisory. Verifying which internal platforms are actually exposed and patched beats trusting a mid-range score to deprioritise it.

Frequently asked questions

Is CVE-2026-29059 being actively exploited? Yes. VulnCheck reports active in-the-wild exploitation against roughly 170 exposed Windmill systems, targeting the superadmin secret.

Which Windmill version fixes CVE-2026-29059? Windmill 1.603.3 (released January 2026) and later. Anything earlier is vulnerable.

Do I need to rotate secrets after patching? Yes, if your instance was internet-exposed while unpatched — the exploit specifically reads SUPERADMIN_SECRET, so rotate it and any other secrets present in the environment.

Does a reverse proxy protect me? No. VulnCheck observed attacks through Nextcloud proxy paths as well as direct endpoints; the fix is upgrading Windmill, not fronting it.

Reporting by The Hacker News; exploitation detail per VulnCheck. CVSS and CWE per the NVD record. Sources linked above. Related: our analysis of the 2025 exploitation timeline.