{"id":1938,"date":"2026-07-22T14:16:04","date_gmt":"2026-07-22T14:16:04","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1938"},"modified":"2026-07-22T14:16:04","modified_gmt":"2026-07-22T14:16:04","slug":"hackers-exploit-windmill-flaw-to-read-arbitrary-server-files-without-authentication","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1938","title":{"rendered":"Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Jul 22, 2026<\/span><\/span>Vulnerability \/ Web Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A high-severity security flaw impacting open-source developer platform Windmill<\/a> has come under active exploitation in the wild, per VulnCheck.<\/p>\n

The vulnerability in question is CVE-2026-29059<\/a><\/strong> (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill’s \u00abget_log_file\u00bb endpoint (\u00ab\/api\/w\/{workspace}\/jobs_u\/get_log_file\/{filename}\u00bb).<\/p>\n

\u00abThe filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ..\/ sequences,\u00bb according to an advisory published<\/a> by Windmill in March 2026.<\/p>\n

\u00abThe primary sensitive value exposed by this vulnerability is the SUPERADMIN_SECRET environment variable, readable via \/proc\/1\/environ. When set, this secret can be used as a Bearer token to authenticate as a superadmin and execute arbitrary code through the job preview API.\u00bb<\/p>\n

However, it’s worth noting that SUPERADMIN_SECRET is not set by default, and for standalone Windmill instances without SUPERADMIN_SECRET configured, the impact of the vulnerability is limited to arbitrary file read. The issue has since been addressed in Windmill 1.603.3, released in January 2026, by adding sanitization checks to the filename parameter to prevent directory traversal.<\/p>\n

According to VulnCheck, whose security researcher Valentin Lobstein is credited with discovering and reporting the flaw, exploitation efforts have been directed against Windmill’s \u00abget_log_file\u00bb endpoint to extract sensitive information from the \u00ab\/etc\/passwd\u00bb file.<\/p>\n

\u00abWe’ve observed exploits aimed at both direct Windmill endpoints and the Nextcloud proxy path,\u00bb Caitlin Condon, vice president of security research at VulnCheck, said<\/a> in a post on LinkedIn.<\/p>\n

The cybersecurity company said it identified about 170 vulnerable systems exposed across 24 countries.<\/p>\n

The disclosure comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added<\/a> four security flaws to its Known Exploited Vulnerabilities (KEV<\/a>) catalog, including two WordPress bugs tracked as wp2shell (CVE-2026-60137 and CVE-2026-63030), along with a stack-based buffer overflow in DD-WRT (CVE-2021-27137) and an unauthenticated remote code execution issue in Langflow (CVE-2026-0770).<\/p>\n

\u00abwp2shell is one of the most significant WordPress Core security events in recent years,\u00bb Wordfence said<\/a>. \u00abThe combination of unauthenticated reachability, no plugin or theme requirement, a large global attack surface, a path to administrator access and code execution, as well as public proof-of-concept exploit availability makes this vulnerability chain unusually serious.\u00bb<\/p>\n

Attack data captured by the WordPress security company shows that threat actors are issuing requests to exploit the REST API batch request route-confusion issue and an unauthenticated SQL injection to achieve code execution.<\/p>\n

As for CVE-2026-0770, KEVIntel’s Ryan Dewhurst told The Hacker News that it first detected exploitation attempts targeting the flaw against its sensors on June 27, 2026, recording 137 exploitation attempts from 46 unique attacker IP addresses associated with 17 countries.<\/p>\n

No less than 75 attempts, which account for more than half of the activity, originated from 20 attacker IP addresses during the last seven days. Observed payloads include base command execution checks, attempts to extract the contents of \u00ab\/etc\/passwd\u00bb or access AWS credentials, environment variable collection, malware downloads using wget or curl, and shell script execution to install second-stage payloads.<\/p>\n

\u00abThe activity is not limited to vulnerability checks,\u00bb Dewhurst said. \u00abWhile much of it involved commands such as id, whoami and reading \/etc\/passwd, we also observed payloads attempting to download malware and obtain environment variables, AWS credentials and container metadata.\u00bb<\/p>\n

Federal Civilian Executive Branch (FCEB) agencies are advised to remediate the identified flaws by July 24, 2026.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Jul 22, 2026Vulnerability \/ Web Security A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck. The vulnerability in question…<\/p>\n","protected":false},"author":1,"featured_media":1939,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1222,396,120,236,70,338,1591,518,2667],"class_list":["post-1938","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-arbitrary","tag-authentication","tag-exploit","tag-files","tag-flaw","tag-hackers","tag-read","tag-server","tag-windmill"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1938"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/1938\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/1939"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1938"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1938"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}