Attackers exploit Windmill flaw to read server files and reach superadmin access

VulnCheck reports active exploitation of a path traversal flaw in Windmill, an open source platform for building internal tools, jobs, and workflows. CVE-2026-29059 lets an unauthenticated attacker read arbitrary files through the log file endpoint, and while observed attempts included reading the password file, the higher value target is the superadmin secret. Where that is configured, an attacker can authenticate as a super administrator and run arbitrary code through the job preview API. VulnCheck counted roughly 170 exposed instances across 24 countries, including deployments reachable through a proxy path rather than directly.

Check

Update Windmill to a fixed release, confirm whether any instance was reachable from the internet, and treat the superadmin secret and any credentials stored in configuration as exposed.

Affected

Organizations running internet-reachable Windmill deployments (CVE-2026-29059); unauthenticated attackers read server files, and where the superadmin secret is set, escalate to full administrative access and code execution.

Fix

Patch to the fixed version, rotate the superadmin secret and stored credentials, keep internal automation platforms off the public internet or behind authentication, and review logs for file read attempts.