Hackers Exploit Windmill Path‑Traversal Flaw (CVE‑2026‑29059) to Read Arbitrary Server Files Without Authentication

Hackers Exploit Windmill Path‑Traversal Flaw (CVE‑2026‑29059) to Read Arbitrary Server Files Without Authentication

What It Is — An unauthenticated path‑traversal vulnerability in the open‑source developer platform Windmill allows an attacker to request any file on the host filesystem via the get_log_file API endpoint.

Exploitability — Active exploitation reported by VulnCheck. Public PoC exists. CVSS 7.5 (High).

Affected Products — Windmill ≥ 2.4.0 (all deployments using the /api/w/{workspace}/jobs_u/get_log_file/{filename} endpoint).

Why It Matters for Compliance & Audit Readiness

• Demonstrates a control‑mapping gap: the missing input validation violates SOC 2 CC6.1 (Change Management) and CC7.1 (System Operations) requirements for secure configuration.
• Continuous evidence of remediation (patch version, WAF rule, code‑review logs) is essential to prove due diligence during a SOC 2 audit.
• Enterprise buyers increasingly request proof that such vulnerabilities are tracked, mitigated, and documented in a centralized Trust Center.

Recommended Actions

• Patch immediately to the Windmill release that addresses CVE‑2026‑29059.
• Deploy a WAF/Reverse‑proxy rule to block path‑traversal patterns on the get_log_file endpoint.
• Conduct a code‑review audit of all file‑path handling functions; enforce sanitization libraries.
• Map the finding to SOC 2 controls (CC6.1, CC7.1) in your compliance tool and capture remediation evidence (patch logs, rule definitions, review sign‑offs).
• Add the endpoint to your continuous monitoring dashboard to alert on anomalous file‑access requests.

Source: The Hacker News – Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication