Skip to content

Windmill CVE-2026-29059 active exploitation

Summary

CVE-2026-29059 is an unauthenticated path-traversal flaw in Windmill's get_log_file endpoint. Versions before 1.603.3 concatenate an attacker-controlled filename into a filesystem path without sufficient sanitization, allowing remote reads with traversal sequences.

VulnCheck reported in-the-wild requests against both direct Windmill endpoints and the Nextcloud proxy path in July 2026. Observed attempts sought /etc/passwd, and the company identified about 170 potentially vulnerable systems across 24 countries. Windmill fixed the flaw in 1.603.3; self-hosted systems exposed while running an older version require both upgrade and compromise assessment.

Tags

Why this matters

  • The endpoint is reachable without authentication, and arbitrary file read can expose application configuration, source material, environment data, credentials, tokens, and host or container metadata.
  • Windmill's advisory identifies /proc/1/environ as a path to the optional SUPERADMIN_SECRET. If configured, that secret can authenticate as superadmin and reach arbitrary code execution through the job-preview API.
  • SUPERADMIN_SECRET is not set by default and is seldom used in ordinary standalone deployments. Do not classify every vulnerable Windmill instance as pre-authentication RCE; the default impact is arbitrary file read.
  • The vendor says Nextcloud Flow's embedded Windmill deployment systematically used the secret. Its predictable /nc_app_flow_data/windmill_users_config.json credential file also created a separate route to full compromise.
  • VulnCheck's observations establish active attempts, but the public reporting reviewed here does not identify successful secret theft, code execution, malware deployment, victim compromise, or actor attribution.

Technical scope

  • Affected versions: Windmill Community and Enterprise editions before 1.603.3.
  • Fixed version: 1.603.3, released in January 2026.
  • Endpoint: /api/w/{workspace}/jobs_u/get_log_file/{filename}.
  • Primitive: unauthenticated ../ path traversal through the filename component.
  • Base impact: arbitrary server-side file read in the Windmill process/container context.
  • Conditional escalation: reading a configured SUPERADMIN_SECRET and using it as a bearer token can provide superadmin access and job-preview code execution.
  • Nextcloud Flow exposure: embedded deployments used the secret and stored admin credentials in a predictable configuration path, according to Windmill's advisory.
  • Severity: NVD scores the file-read primitive CVSS 3.1 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Observed activity

VulnCheck told The Hacker News that exploitation attempts targeted get_log_file to retrieve /etc/passwd. Requests covered direct Windmill routes and the Nextcloud proxy path. The reported count of roughly 170 systems in 24 countries is an exposure estimate, not a victim count.

No public source reviewed for this entry established that the observed requests obtained SUPERADMIN_SECRET, authenticated as superadmin, or executed code. Preserve that distinction when triaging scanner traffic and assigning incident severity.

Detection and triage

  • Inventory self-hosted Windmill and Nextcloud Flow deployments, including container images, pinned manifests, embedded components, and systems reachable only through internal proxies.
  • Confirm the effective Windmill version and image digest. Do not assume a host application update replaced an embedded or independently pinned Windmill image.
  • Search CDN, WAF, reverse-proxy, ingress, Nextcloud, and Windmill logs for get_log_file requests containing encoded or decoded traversal sequences, especially requests resolving toward /etc/passwd, /proc/1/environ, or the Nextcloud Flow configuration path.
  • Correlate suspicious reads with bearer-token authentication, superadmin actions, job-preview API use, newly created jobs or flows, process execution, child shells, download utilities, and unexpected outbound traffic.
  • Review filesystem and container telemetry for access to environment files, application configuration, cloud or orchestrator credentials, SSH material, source-control tokens, and mounted secrets by the Windmill process.
  • Preserve request paths in both raw and normalized form. Proxies and frameworks may decode, rewrite, collapse, or reject traversal syntax differently.
  • If the service was exposed while vulnerable, review Windmill audit history, job and workflow changes, account changes, API-token use, secret access, process trees, container events, and adjacent cloud or source-control activity from the exposure window.

Response guidance

  1. Upgrade self-hosted Windmill to 1.603.3 or a newer supported release and verify every replica, worker, embedded deployment, and stale image was replaced.
  2. Move Nextcloud Flow away from the legacy embedded-Windmill arrangement where supported, following the vendor's native-trigger integration guidance, and update any remaining Windmill component independently.
  3. Restrict Windmill and its worker/control endpoints to intended users and proxies. Remove direct internet or lateral network reachability where it is not required.
  4. If traversal attempts succeeded or logs are incomplete, rotate SUPERADMIN_SECRET, Windmill tokens, Nextcloud Flow credentials, database credentials, cloud and orchestrator identities, source-control tokens, and other secrets readable by the service after containment.
  5. Invalidate sessions and review superadmin, job-preview, workflow, script, schedule, variable, resource, and credential changes for persistence or code execution.
  6. Rebuild affected workloads from trusted images when conditional RCE or broader credential access is plausible; patching does not reverse actions performed with a stolen secret.

Sources