CVE-2026-29059: Active Exploitation of Windmill Path Traversal — Detection & Remediation

Introduction

A critical security vulnerability in the open-source developer platform Windmill, tracked as CVE-2026-29059, is currently under active exploitation in the wild. According to intelligence from VulnCheck, threat actors are leveraging this flaw to read arbitrary files from exposed servers without requiring authentication.

Given Windmill's use case for automating internal workflows and handling sensitive data, this vulnerability represents a severe risk of data exfiltration and credential compromise. Defenders must assume that any unpatched, internet-facing Windmill instance is currently being targeted or compromised.

Technical Analysis

• CVE Identifier: CVE-2026-29059
• CVSS Score: 7.5 (High)
• Affected Component: get_log_file API endpoint
• Attack Vector: Network

The Vulnerability: The flaw resides in the /api/w/{workspace}/jobs_u/get_log_file/{filename} endpoint. The application takes the filename parameter from the URL and concatenates it directly into a file path without proper validation or sanitization.

The Exploitation Mechanism: By utilizing path traversal sequences (such as ../), an unauthenticated attacker can navigate out of the intended log directory. This allows them to request and read arbitrary files on the server's file system.

In a typical attack scenario observed in the wild:

1. The attacker sends a crafted HTTP GET request to the target endpoint.
2. The filename includes traversal payloads (e.g., ../../etc/passwd or ../../.env).
3. The server responds with the contents of the requested file.

Impact: This is not just a directory listing issue; it is arbitrary file read. Attackers can harvest:

• Application secrets (API keys, database credentials) stored in environment files (.env).
• Source code to identify further logic flaws.
• Configuration files to map the internal network infrastructure.
• SSH keys or cloud metadata credentials (if running in specific cloud environments).

Exploitation Status: VulnCheck has confirmed active exploitation. This is not theoretical; probes and exploits are occurring now.

Detection & Response

Given the active exploitation status, immediate threat hunting is required. The following rules and queries are designed to identify successful exploitation attempts against the specific endpoint involved in CVE-2026-29059.

SIGMA Rules

---
title: Windmill Path Traversal Exploitation Attempt CVE-2026-29059
id: 8a2b1c9d-0e3f-4a5b-8c6d-1e2f3a4b5c6d
status: experimental
description: Detects unauthenticated path traversal attempts against Windmill get_log_file endpoint indicative of CVE-2026-29059 exploitation.
references:
  - https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: web
  product: nginx
detection:
  selection:
    url|contains: '/jobs_u/get_log_file/'
    url|contains:
      - '../'
      - '..%2f'
      - '..%5c'
  condition: selection
falsepositives:
  - Legitimate administrative debugging (rarely unauthenticated)
level: critical
---
title: Suspicious Access to Windmill Log Endpoint
id: 9b3c2d0e-1f4a-5b6c-9d7e-2f3a4b5c6d7e
status: experimental
description: Identifies access to the sensitive Windmill get_log_file endpoint which should be strictly controlled. High volume of requests may indicate scanning.
references:
  - https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html
author: Security Arsenal
date: 2026/07/15
tags:
  - attack.discovery
  - attack.t1083
logsource:
  category: web
  product: apache
detection:
  selection:
    cs_uri_stem|contains: '/jobs_u/get_log_file/'
  condition: selection
falsepositives:
  - Authorized developer debugging sessions
level: high

KQL (Microsoft Sentinel / Defender)

// Hunt for CVE-2026-29059 exploitation indicators in Web Logs/Syslog
// Note: Adjust table names based on your ingestion format (Syslog, CommonSecurityLog, DeviceNetworkEvents)
Syslog
| where SyslogMessage has_all ("jobs_u/get_log_file", "..") 
| extend RequestUrl = extract(@'GET\s+([^\s]+)', 1, SyslogMessage)
| extend SourceIP = extract(@'([\d\.]+)\s+-\s+-', 1, SyslogMessage)
| project TimeGenerated, SourceIP, Computer, RequestUrl, SyslogMessage
| order by TimeGenerated desc

Velociraptor VQL

-- Hunt for Windmill exploitation attempts in Nginx/Apache access logs
LET log_files = SELECT FullPath FROM glob(globs='/var/log/nginx/*.log')
   UNION SELECT FullPath FROM glob(globs='/var/log/httpd/*.log')
   UNION SELECT FullPath FROM glob(globs='/var/log/apache2/*.log')

SELECT 
   FullPath,
   timestamp(epoch=int(int=_Source.ts)) as EventTime,
   _Source.remote_addr as SourceIP,
   _Source.request as Request
FROM foreach(row=log_files, 
  query={
     SELECT * FROM parse_lines(filename=FullPath, accessor='auto') 
     WHERE request =~ 'jobs_u/get_log_file' AND request =~ '\.\.'
  })
LIMIT 100

Remediation Script (Bash)

#!/bin/bash
# Emergency check for CVE-2026-29059 indicators on Linux servers

LOG_LOCATIONS="/var/log/nginx /var/log/apache2 /var/log/httpd"

echo "[*] Hunting for indicators of CVE-2026-29059 exploitation..."

for dir in $LOG_LOCATIONS; do
    if [ -d "$dir" ]; then
        echo "[*] Scanning $dir ..."
        # grep for the endpoint combined with path traversal characters
        grep -R "jobs_u/get_log_file" "$dir" 2>/dev/null | grep -E "(\.\.|%2e%2e|%252e%252e)"
    fi
done

echo "[*] Analysis complete."
echo "[!] WARNING: If matches are found above, your server may have been compromised."
echo "[*] Immediate remediation: Apply the latest Windmill patches and rotate all credentials."

Remediation

1. Patch Immediately: Apply the security patches released by the Windmill team. Ensure you are running the latest version available in the 2026 release branch. Check the official Windmill GitHub repository or release notes for the specific version addressing CVE-2026-29059.

2. Restrict Network Access: Until patching is complete, restrict access to the Windmill interface via IP whitelisting. Ensure the /api/ endpoints are not accessible from the broader internet if not strictly required for operations.

3. Log Audit: Review all access logs for the /api/w/{workspace}/jobs_u/get_log_file/ endpoint. Look for successful HTTP 200 OK responses where the URL parameter contains ../ or URL-encoded variants. This indicates successful data exfiltration.

4. Credential Rotation: If exploitation is confirmed, assume that environment variables (.env) and configuration files have been read. Rotate all database credentials, API keys, and cloud secrets immediately.

5. WAF Configuration: Update Web Application Firewall rules to block requests containing path traversal sequences (../, ..%2f, ..\) targeting the /jobs_u/get_log_file/ path specifically.

Related Resources

Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub