High severity · published Mar 6, 2026
CVE-2026-29059
Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly
7.5
CVSS
3%
EPSS
No
On KEV
Description
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})". The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences. This issue has been patched in version 1.603.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)3.0% · higher than 87% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WI
windmill · windmill-labs
< 1.603.3 · source: vendor, NVD
In the news
VulnerabilityHigh
Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.
The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's "get_log_file" endpoint ("/api/w/{workspace}/jobs_u/get_log_file/{filename}").
"The filename parameter is concatenated into
Jul 22, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-29059
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-29059
Release Notes
https://github.com/windmill-labs/windmill/releases/tag/v1.603.3
Vendor Advisory
https://github.com/windmill-labs/windmill/security/advisories/GHSA-24fr-44f8-fqwg
Product
https://github.com/Chocapikk/Windfall
More from windmill
8.1
CVE-2026-47107
Windmill < 1.703.2 Incorrect Default Permissions in nsjail Configuration
7.2
CVE-2026-33881
Windmill: Rogue Workspace Admins can inject code via unescaped workspace environment variable interpolation in NativeTS executor
6.5
CVE-2026-72541
Windmill Labs Windmill - Missing Authorization
6.5
CVE-2026-72539
Windmill Labs Windmill - Information Disclosure
5.4
CVE-2026-72542
Windmill Labs Windmill - Missing Authorization