Hackers Exploit Windmill Path‑Traversal Flaw (CVE‑2026‑29059) to Read Arbitrary Server Files Without Authentication

Hackers Exploit Windmill Path‑Traversal Flaw (CVE‑2026‑29059) to Read Arbitrary Server Files Without Authentication

What It Is — An unauthenticated path‑traversal vulnerability in the open‑source developer platform Windmill allows an attacker to request any file on the host filesystem via the get_log_file API endpoint.

Exploitability — Active exploitation reported by VulnCheck. Public PoC exists. CVSS 7.5 (High).

Affected Products — Windmill ≥ 2.4.0 (all deployments using the /api/w/{workspace}/jobs_u/get_log_file/{filename} endpoint).

Why It Matters for Compliance & Audit Readiness

• Demonstrates a control‑mapping gap: the missing input validation violates SOC 2 CC6.1 (Change Management) and CC7.1 (System Operations) requirements for secure configuration.
• Continuous evidence of remediation (patch version, WAF rule, code‑review logs) is essential to prove due diligence during a SOC 2 audit.
• Enterprise buyers increasingly request proof that such vulnerabilities are tracked, mitigated, and documented in a centralized Trust Center.

Recommended Actions

1. Patch immediately to the Windmill release that addresses CVE‑2026‑29059.
2. Deploy a WAF/Reverse‑proxy rule to block path‑traversal patterns on the get_log_file endpoint.
3. Conduct a code‑review audit of all file‑path handling functions; enforce sanitization libraries.
4. Map the finding to SOC 2 controls (CC6.1, CC7.1) in your compliance tool and capture remediation evidence (patch logs, rule definitions, review sign‑offs).
5. Add the endpoint to your continuous monitoring dashboard to alert on anomalous file‑access requests.

Source: The Hacker News – Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication