# Unauthenticated Path Traversal in Windmill Now Under Active Exploitation
## The Threat
Windmill, the open-source developer platform used by engineering teams to build internal tools and automate workflows, has a path traversal vulnerability that requires no authentication to exploit — and attackers are already using it. CVE-2026-29059 lives in the get_log_file endpoint (/api/w/{workspace}/jobs_u/get_log_file/{filename}), where the filename parameter is concatenated directly into a server-side file path without sanitization. That means an unauthenticated attacker can feed directory traversal sequences like ../../etc/passwd through the API and read files anywhere the Windmill process can reach on the underlying filesystem.
The sting here is in the endpoint name. That _u suffix in jobs_u is Windmill's convention for endpoints that are intentionally unauthenticated — designed to allow job log retrieval without requiring a session token. It's a reasonable feature on paper; you might want external systems or dashboards to fetch job output without managing credentials. In practice, it became a zero-authentication file read primitive. VulnCheck has confirmed active exploitation in the wild, meaning defenders do not have the luxury of a quiet patch window.
What makes this particularly dangerous for organizations running Windmill is the nature of the platform itself. Windmill instances are typically deployed close to secrets. Environment variables, script parameters, database credentials, and API keys often live in the same execution environment. A path traversal on a log endpoint isn't just about reading log files — on a Windmill server, it's potentially about reading /proc/self/environ, configuration files, SSH keys, or anything else the service account can touch.
## Severity and Impact
| Field | Detail |
|---|---|
| CVE | CVE-2026-29059 |
| CVSS Score | 7.5 (High) |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| CWE | CWE-22 — Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) |
| Attack Complexity | Low |
| Authentication Required | None |
| User Interaction Required | None |
| Privileges Required | None |
| Exploitation Status | Actively exploited in the wild (VulnCheck) |
## Affected Products
- Self-hosted deployments (Docker, Kubernetes, bare-metal)
- Any instance where the jobs_u/get_log_file endpoint is network-accessible
Cloud-hosted Windmill instances managed by Windmill Labs should be checked for vendor-applied patches; self-managed deployments are the primary exposure surface.
## Mitigations
Patch immediately. Apply the latest Windmill release that addresses CVE-2026-29059. This is an actively exploited vulnerability with no authentication requirement — there is no acceptable delay window here.
While patching, restrict access at the network layer. If your Windmill instance is reachable from the public internet or broad internal networks, place it behind a VPN or restrict ingress to known IP ranges via firewall rules or reverse proxy ACLs. The vulnerable endpoint does not require auth, so network segmentation is the only effective compensating control before patching.
Audit your Windmill service account's filesystem permissions. The blast radius of this vulnerability scales with what the Windmill process can read. If it runs as root or with overly broad permissions, an attacker can read far more than job logs. Lock down the service account to the minimum necessary directories and ensure secrets are not stored in plaintext on the filesystem where Windmill operates.
Check for signs of exploitation. Review web server and application logs for requests to /api/w/*/jobs_u/get_log_file/ containing traversal sequences (../, ..%2F, ..%252F, or other encoded variants). If your Windmill instance has been internet-exposed, assume breach and rotate any secrets the service account could have accessed.
Consider Windmill's _u endpoint surface as a permanent review target. Any endpoint using the unauthenticated convention deserves scrutiny. Audit what other _u routes exist in your Windmill version and whether any accept user-controlled path-like parameters.
## References
---
## HackWire Analysis
Path traversal vulnerabilities are old news — CWE-22 has been in the OWASP Top 10 in various forms for over a decade. What makes CVE-2026-29059 interesting isn't the class of vulnerability; it's the target and what that target holds.
Windmill sits at an unusual intersection: it's a developer-facing automation platform, which means it's often deployed with direct access to production secrets, database connections, and API credentials. Unlike a simple web app, Windmill is the glue between infrastructure components. Its job logs alone might contain leaked credentials from careless script authors. Its environment variables almost certainly do. A path traversal here isn't a stepping stone — it may be a destination.
The _u endpoint design deserves a second look beyond this specific CVE. The pattern of creating intentionally unauthenticated API routes for convenience is a recurring source of vulnerabilities in developer tooling. We saw similar issues in Jenkins (unauthenticated script console in older configurations), Grafana (unauthenticated snapshot APIs), and various CI/CD platforms. Developer tools optimize for frictionless access, and that culture sometimes bleeds into the security model in ways that only become visible when someone starts fuzzing.
For security teams: if you're running any open-source developer platform — Windmill, n8n, Prefect, Temporal, or similar — the question isn't just "is this patched?" It's "what can this service account read, and what would an attacker find if they got arbitrary file read?" Answering that second question now, before a patch gap opens, is the more durable investment. Internal developer tooling tends to get less scrutiny than customer-facing surfaces. VulnCheck confirming active exploitation on a CVSS 7.5 unauthenticated vulnerability should reset those assumptions.
— HackWire Editorial
## Related Coverage