Active exploitation of Windmill vulnerability

Threat summary

On July 22, 2026, researchers reported active exploitation of CVE-2026-29059, a vulnerability affecting Windmill, an open-source platform used to build and automate internal applications, application programming interfaces (APIs), workflows, background jobs, and user interfaces.

Researchers observed threat actors targeting internet-exposed Windmill deployments and using the vulnerability to retrieve files such as /etc/passwd from affected systems.

Windmill addressed the issue in version 1.603.3, released in January 2026. The vulnerability was publicly disclosed and assigned CVE-2026-29059 on March 6, 2026, and a public proof-of-concept (PoC) became available shortly afterward.

CVE-2026-29059, rated with a Common Vulnerability Scoring System (CVSS) score of 7.5, is described as an unauthenticated path traversal vulnerability. The flaw allows a threat actor to request files outside the intended log directory and read files accessible to the Windmill process.

The impact depends on how Windmill is deployed and what information is available to the Windmill service.

In standalone self-hosted deployments, a threat actor may access any file readable by the Windmill process. Depending on the deployment, this may include application configuration files, source code, environment variables, database connection strings, cloud credentials, authentication tokens, and other operational secrets.

The impact increases in deployments where SUPERADMIN_SECRET is configured; the flaw may expose this secret, allowing a threat actor to authenticate as a Windmill super administrator. According to the advisory, the resulting privileged access may provide a path to arbitrary code execution. Public reporting currently confirms file-read exploitation but does not provide evidence of successful exploitation of this attack path.

The deployments where Windmill is embedded within Nextcloud Flow represent the highest-risk scenario described in the advisory because SUPERADMIN_SECRET is always present in that architecture, and administrative credentials are stored in predictable configuration files. According to the advisory, successful exploitation may expose privileged credentials used to manage the Windmill environment.

Recommendations

In many organizations, Windmill serves as an orchestration layer between business applications and infrastructure. The platform is commonly deployed with trusted access to cloud services, databases, software development pipelines, internal application programming interfaces (APIs), and other business systems. As a result, the impact would depend on the information available to the Windmill process.

Upgrade self-hosted Windmill deployments to version 1.603.3 or later and verify that all internet-facing instances are running supported releases. Review Windmill and web server logs for requests targeting the get_log_file endpoint, particularly requests containing directory traversal sequences or attempts to access operating system files, environment variables, and configuration files.

Inventory all Windmill deployments, determine whether SUPERADMIN_SECRET is configured, identify credentials and secrets accessible to the Windmill process, document external integrations, and verify internet exposure.

Review deployments integrated with Nextcloud Flow for privileged credentials stored in configuration files and application settings. Where unauthorized file access is suspected, rotate administrative credentials, service account credentials, API keys, authentication tokens, and application secrets that may have been exposed.

Stay on top of emerging threats like this.

Sign up to receive a weekly roundup of our security intelligence feed. You'll be the first to know of emerging attack vectors, threats, and vulnerabilities. 

Sign up