Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
Active exploitation of CVE-2026-29059, a path traversal vulnerability in the open-source developer platform Windmill, allows unauthorized reading of arbitrary server files. The vulnerability impacts the "get_log_file" endpoint and can lead to full system compromise if the SUPERADMIN_SECRET environment variable is exposed and configured. CISA has added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including severe flaws in WordPress (WP2Shell), Langflow, and DD-WRT
Analysis
TL;DR
- Active exploitation of CVE-2026-29059, a path traversal vulnerability in the open-source developer platform Windmill, allows unauthorized reading of arbitrary server files.
- The vulnerability impacts the "get_log_file" endpoint and can lead to full system compromise if the SUPERADMIN_SECRET environment variable is exposed and configured.
- CISA has added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including severe flaws in WordPress (WP2Shell), Langflow, and DD-WRT.
- Threat actors are actively deploying complex payloads against Langflow, including malware downloads, credential harvesting, and second-stage payload installation.
Why It Matters
This update highlights the escalating risk to open-source infrastructure, particularly tools widely used in AI and development workflows like Windmill and Langflow. The inclusion of multiple high-severity flaws in CISA’s KEV catalog signals a coordinated push by attackers to exploit unpatched enterprise and government systems, necessitating immediate remediation to prevent unauthorized access and data breaches.
Technical Details
- Windmill Vulnerability (CVE-2026-29059): A CVSS 7.5 unauthenticated path traversal flaw in the
/api/w/{workspace}/jobs_u/get_log_file/{filename}endpoint. Lack of input sanitization allows../sequences to read arbitrary files, potentially exposing theSUPERADMIN_SECRETvia/proc/1/environfor privilege escalation. - WordPress WP2Shell: A critical chain involving REST API batch request route confusion and unauthenticated SQL injection, leading to arbitrary code execution without requiring plugins or themes. Over two dozen unique PoCs have been verified.
- Langflow RCE (CVE-2026-0770): An unauthenticated remote code execution flaw actively exploited since late June 2026. Attacks involve command execution checks (
id,whoami), extraction of AWS credentials and environment variables, and deployment of malware viawgetorcurl. - DD-WRT Buffer Overflow: CVE-2021-27137, a stack-based buffer overflow, was also added to the KEV catalog, indicating continued targeting of legacy IoT firmware.
Industry Insight
- Immediate Patching Required: Organizations using Windmill must upgrade to version 1.603.3 or later and ensure
SUPERADMIN_SECRETis not exposed in accessible environment variables. WordPress administrators should patch immediately due to the high volume of active exploits. - Supply Chain Vigilance: The targeting of AI-specific tools like Langflow suggests attackers are prioritizing environments where they can execute arbitrary code to harvest cloud credentials (e.g., AWS) and establish persistent access.
- Regulatory Compliance: Federal Civilian Executive Branch agencies have a strict deadline of July 24, 2026, to remediate these flaws. Private sector entities should align their patching cycles with CISA’s KEV updates to mitigate known active threats.
Disclaimer: The above content is generated by AI and is for reference only.