A critical vulnerability in Windmill's workflow platform lets attackers read any file on your server without logging in. If you're running an unpatched instance, they've likely already done it.
What Happened
CVE-2026-29059 is an unauthenticated path traversal flaw in Windmill, an open-source workflow automation platform. The vulnerability scores 7.5 on CVSS, which undersells its severity. Attackers can read arbitrary files from your server by sending crafted requests with ../ sequences to the get_log_file endpoint. No credentials are required.
VulnCheck reported active exploitation in the wild. The primary target: instances with the SUPERADMIN_SECRET environment variable set. Once an attacker extracts this value, they gain superadmin access to your entire Windmill deployment.
Timeline
The exact discovery date isn't public, but here's what we know:
- Windmill 1.603.3 released: Maintainers added sanitization checks to prevent path traversal on the affected endpoint.
- Exploitation begins: VulnCheck observed active scanning and exploitation targeting the
get_log_fileendpoint. - Public disclosure: CVE-2026-29059 published with technical details of the vulnerability.
The gap between patch availability and widespread exploitation underscores a familiar problem: organizations don't patch fast enough, even when fixes exist.
Which Controls Failed
Three distinct control failures enabled this incident:
Input validation was missing. The get_log_file endpoint accepted user-supplied file paths without sanitization. Any request containing ../ sequences traversed the directory structure unchecked. This violates the basic principle of secure coding: never trust user input.
Authentication wasn't enforced. Reading server logs is an administrative function. The endpoint should have required authentication and authorization checks before processing any request. Instead, it was wide open.
Sensitive configuration was exposed. The SUPERADMIN_SECRET environment variable was stored in a location accessible through path traversal. Environment variables containing secrets should never be readable by application-level file access operations.
What Standards Require
Let's map these failures to specific requirements you're already supposed to meet:
PCI DSS v4.0.1 Requirement 6.2.4 says you must address common coding vulnerabilities during software development. Path traversal appears in every secure coding reference, including the OWASP Top 10 2021 under A01:2021, Broken Access Control. If you process payment data and you're running Windmill, this is a direct PCI failure.
OWASP ASVS v4.0.3 Section 5.2.2 requires that applications verify file paths don't escape the intended directory. Your code should canonicalize paths and check them against an allowlist before file operations. The Windmill flaw violated this completely.
ISO/IEC 27001:2022 Control 8.3 mandates that access to information and systems is restricted based on business requirements. Unauthenticated access to server files fails this control. Your auditor will ask how you enforce least privilege on file access.
NIST 800-53 Rev 5 Control AC-3 requires access enforcement for all system resources. An unauthenticated endpoint that reads arbitrary files violates this at the most basic level.
If you're pursuing SOC 2 Type II, your auditors will examine how you control access to sensitive data. An unauthenticated file read endpoint is evidence of inadequate access controls, directly impacting CC6.1 (logical access controls).
Lessons and Action Items
Here's what you do next:
Patch immediately. If you're running Windmill, upgrade to version 1.603.3 or later today. Check your deployment method (Docker, Kubernetes, bare metal) and follow the upgrade path for your environment. Don't wait for your next maintenance window.
Audit your open-source dependencies. Maintain an inventory of every open-source component in your stack with version numbers and known vulnerabilities. Tools like OWASP Dependency-Check or Snyk can automate this. Run the scan weekly, not quarterly.
Secure your environment variables. Never store secrets in environment variables that your application can read through normal file operations. Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, Azure Key Vault) with runtime injection. If you must use environment variables, restrict file system access so application code can't read /proc/self/environ or similar paths.
Implement path sanitization everywhere. Review every endpoint that accepts file paths or filenames. Canonicalize the path, validate it against an allowlist of permitted directories, and reject anything with traversal sequences. Don't just filter ../, attackers use URL encoding, Unicode variations, and other bypasses.
Require authentication on administrative functions. Any endpoint that reads logs, configuration files, or system information must require authentication and authorization. Map each endpoint to a role and verify the user's role before processing the request.
Test for path traversal in your SDLC. Add path traversal test cases to your security testing. If you're doing dynamic testing (DAST), configure your scanner to test file path parameters. If you're doing code review, flag any file operation that uses user-supplied input without sanitization.
Monitor for exploitation attempts. Set up alerts for requests containing ../ sequences, especially to endpoints that handle files. Review your web application firewall (WAF) rules and ensure they block directory traversal patterns. Check your logs for requests to get_log_file or similar endpoints with suspicious parameters.
The Windmill incident isn't unique. Path traversal vulnerabilities appear constantly because developers still trust user input and security teams still patch too slowly. Your job is to fix both problems in your environment before the next CVE drops.
