Affected Systems
Windmill developer platform (open-source version), all versions prior to patch. The vulnerability affects the "get_log_file" endpoint and allows unauthenticated access.
Exploitation Status
Active exploitation confirmed in the wild. Attackers are leveraging CVE-2026-29059 to read arbitrary files from vulnerable Windmill servers without authentication.
Business Impact
Unauthenticated attackers can read arbitrary server files including configuration files, credentials, environment variables, application source code, and sensitive logs. This can lead to credential theft, lateral movement, and full system compromise. Organizations running Windmill in production face immediate risk of data breach and infrastructure compromise.
Urgency
🔴 Immediate
Recommended Actions
- Immediately identify all Windmill platform instances in your environment using asset inventory and network scanning
- Apply vendor security patches for CVE-2026-29059 as soon as available; check Windmill GitHub releases and security advisories
- If patching is not immediately possible, restrict network access to Windmill instances using firewall rules or place behind VPN/authentication proxy
- Review server logs for suspicious access to the get_log_file endpoint, particularly requests with path traversal sequences (../, %2e%2e%2f)
- Rotate all credentials, API keys, and secrets that may have been exposed on affected Windmill servers