Critical Windmill Path Traversal Bug Under Active Attack — 170 Servers Exposed

A high-severity path traversal vulnerability in the open-source Windmill developer platform is being actively exploited in the wild, according to threat intelligence from VulnCheck. Tracked as CVE-2026-29059 with a CVSS score of 7.5, the flaw resides in Windmill's `/api/w/{workspace}/jobs_u/get_log_file/{filename}` endpoint, where the `filename` parameter is concatenated into a file path without sanitization. Discovered and reported by VulnCheck researcher Valentin Lobstein, the unauthenticated bug allows attackers to read arbitrary files on the server using `../` directory traversal sequences. Windmill patched the issue back in January 2026 with version 1.603.3, but unpatched deployments remain at risk — particularly any instance where the `SUPERADMIN_SECRET` environment variable is configured, since reading `/proc/1/environ` could expose it as a Bearer token granting superadmin privileges and arbitrary code execution via the job preview API.

VulnCheck has observed threat actors weaponizing the flaw against Windmill's `get_log_file` endpoint to extract `/etc/passwd`, with exploitation attempts also detected through a Nextcloud proxy path. Caitlin Condon, vice president of security research at VulnCheck, confirmed the campaign via LinkedIn, noting that roughly 170 vulnerable Windmill systems are exposed across 24 countries. The disclosure serves as a reminder that even "internal" infrastructure like developer job runners can leak sensitive credentials — a critical concern for any team running self-hosted CI/CD stacks. Admins can verify their own server hardening posture by running a quick SSL/TLS configuration check and a port scan to confirm no unintended services are reachable from the public internet.

The Windmill finding coincides with CISA adding four new entries to its Known Exploited Vulnerabilities (KEV) catalog. Two severe WordPress Core flaws — CVE-2026-60137 and CVE-2026-63030, collectively dubbed "wp2shell" — top the list, with Wordfence calling the chain "one of the most significant WordPress Core security events in recent years." The exploit chain leverages a REST API batch request route-confusion issue and an unauthenticated SQL injection to achieve full code execution on vulnerable sites, with no plugins or themes required. VulnCheck has verified more than two dozen unique public PoCs targeting wp2shell as of July 19, 2026, dramatically amplifying the attack surface for the millions of WordPress deployments worldwide. Rounding out the KEV additions are a stack-based buffer overflow in DD-WRT (CVE-2021-27137) and an unauthenticated remote code execution bug in the AI workflow platform Langflow (CVE-2026-0770).

Federal agencies are now operating under CISA-mandated remediation deadlines for all four vulnerabilities, and private-sector organizations are strongly urged to follow suit. Windmill users running versions prior to 1.603.3 should upgrade immediately, audit environment variables for any signs of compromise, and rotate any secrets that may have been readable through the traversal path. WordPress administrators should apply the latest Core security release and monitor access logs for anomalous batch REST requests. As active exploitation of edge software continues to accelerate, defenders should pair timely patching with continuous exposure monitoring — starting with a comprehensive privacy and exposure checkup to identify what an attacker could see from the outside before adversaries beat them to it.