Critical Security Flaw Discovered in Windmill Platform
Hackers can read server files without authentication.
1Critical Vulnerability in Windmill
A high-severity security flaw was discovered in the open-source developer platform Windmill. Tracked as CVE-2026-29059, this vulnerability in the 'get_log_file' endpoint allows unauthenticated file reads. Attackers can access any server file using '../' directory traversal sequences.
2Superadmin Access Risk
The flaw permits reading the SUPERADMIN_SECRET environment variable, potentially granting superadmin privileges. This secret key could be used to execute arbitrary code via the job preview API. However, the variable isn't set by default, mitigating some risk.
3Widespread Exploitation Attempts
Security firm VulnCheck confirmed active attacks targeting this vulnerability. Attackers particularly attempt to extract sensitive information from '/etc/passwd' files. Over 170 vulnerable systems across 24 countries were identified.
4Patch and Update
Windmill addressed the issue in version 1.603.3 released in January 2026. Added filename parameter sanitization prevents directory traversal. Users must update to the latest version as critical priority.
5Other Critical Vulnerabilities
US Cybersecurity Agency CISA simultaneously added four new vulnerabilities to its KEV catalog, including WordPress's wp2shell and Langflow's remote code execution flaws.
6Industry-Wide Alert
This incident demonstrates the widespread impact of security vulnerabilities in open-source platforms. Organizations must implement security updates promptly and tighten server access controls. Proactive security measures are now imperative.
Original article: The Hacker News — Windmill Platformunda Kritik Güvenlik Açığı Keşfedildi