Windmill actively exploited path traversal (CVE-2026-29059)
Vulnerability
Summary
Hide ▲
Show ▼
CVE-2026-29059 is an actively exploited unauthenticated path-traversal flaw in Windmill's get_log_file endpoint that can expose arbitrary server files. Attackers can use `../` sequences to read data such as /etc/passwd and, on systems with SUPERADMIN_SECRET configured, potentially recover a token that enables superadmin access and arbitrary code execution. Windmill 1.603.3 fixed the issue by sanitizing the filename parameter. Exposure data shows about 170 vulnerable systems across 24 countries, keeping the risk broad for unpatched deployments.
Related Happenings
CISA adds four actively exploited flaws to KEV with FCEB deadlines
Public Sector Action
H score35
First: 13.02.2026 10:34
Last: 13.02.2026 10:34
Sources 1
About this happening:
CISA added four vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation, putting FCEB agencies on a forced remed...
CISA adds four actively exploited flaws to KEV with FCEB deadlines
Public Sector ActionAbout this happening: CISA added four vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation, putting FCEB agencies on a forced remed...
SolarWinds Web Help Desk (WHD) multi-stage exploitation wave
Exploitation Wave
H score44
First: 09.02.2026 16:42
Last: 09.02.2026 16:42
Sources 1
About this happening:
SolarWinds Web Help Desk (WHD) exploitation is a multi-stage intrusion wave affecting internet-exposed WHD instances. The foothold remains unconfirmed, but the wave is...
SolarWinds Web Help Desk (WHD) multi-stage exploitation wave
Exploitation WaveAbout this happening: SolarWinds Web Help Desk (WHD) exploitation is a multi-stage intrusion wave affecting internet-exposed WHD instances. The foothold remains unconfirmed, but the wave is...
Latest development: 10.03.2026 08:17
CISA added CVE-2025-26399 in SolarWinds Web Help Desk to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation, said Microsoft and Huntress had reported threat actors using SolarWinds Web Help Desk flaws to obtain initial access, attributed the activity to the Warlock ransomware crew, and ordered Federal Civilian Executive Branch (FCEB) agencies to apply the fix by March 12, 2026.
CISA KEV remediation deadline for SolarWinds WHD CVE-2025-40551
Public Sector Action
H score53
First: 04.02.2026 07:50
Last: 04.02.2026 07:50
Sources 1
About this happening:
CISA added CVE-2025-40551 in SolarWinds Web Help Desk to the KEV catalog and imposed federal remediation deadlines, turning a newly exploited flaw into a compl...
CISA KEV remediation deadline for SolarWinds WHD CVE-2025-40551
Public Sector ActionAbout this happening: CISA added CVE-2025-40551 in SolarWinds Web Help Desk to the KEV catalog and imposed federal remediation deadlines, turning a newly exploited flaw into a compl...
CISA BOD 22-01 federal remediation directive
Public Sector Action
H score89
First: 23.01.2026 20:47
Last: 23.01.2026 20:47
Sources 1
About this happening:
CISA required federal agencies covered by BOD 22-01 to apply available security updates or vendor-suggested mitigations, or stop using the affected products by Febru...
CISA BOD 22-01 federal remediation directive
Public Sector ActionAbout this happening: CISA required federal agencies covered by BOD 22-01 to apply available security updates or vendor-suggested mitigations, or stop using the affected products by Febru...
Timeline
-
22.07.2026 15:36 2 articles · 2h ago
Windmill get_log_file path traversal is actively exploited
Initial DisclosureWindmill's `get_log_file` endpoint is under active exploitation for CVE-2026-29059, an unauthenticated path traversal that lets attackers read arbitrary files with `../` sequences. When `SUPERADMIN_SECRET` is configured, the exposed secret can be read from `/proc/1/environ` and used as a Bearer token for superadmin authentication and arbitrary code execution through the job preview API. Windmill says the flaw was fixed in 1.603.3 by sanitizing the filename parameter, and VulnCheck says it has seen exploitation aimed at `/etc/passwd` along with roughly 170 vulnerable systems exposed across 24 countries.
Show sources
- Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication — thehackernews.com — 22.07.2026 15:36
- Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication — thehackernews.com — 22.07.2026 15:36