Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
Summary: VulnCheck reported active exploitation of CVE-2026-29059, a CVSS 7.5 unauthenticated path traversal in Windmill's get_log_file endpoint that lets attackers read arbitrary server files via ../ sequences, with exploits observed against both direct Windmill endpoints and a Nextcloud proxy path. Windmill fixed the flaw in version 1.603.3 by adding filename sanitization, and VulnCheck identified about 170 vulnerable systems exposed across 24 countries.
What's compelling: The flaw's real prize is the SUPERADMIN_SECRET environment variable readable via /proc/1/environ, which when set lets an attacker authenticate as superadmin and execute arbitrary code - and CISA's KEV additions, including the wp2shell WordPress chain and a Langflow RCE, carry a July 24, 2026 remediation deadline for federal agencies.