Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
Summary
A critical security flaw in the open-source developer platform Windmill, identified as CVE-2026-29059, is being actively exploited by hackers. This vulnerability allows attackers to read arbitrary server files without authentication by exploiting an unauthenticated path traversal in the 'get_log_file' endpoint.
IFF Assessment
The active exploitation of an unauthenticated path traversal vulnerability poses a direct threat to systems using Windmill, enabling attackers to access sensitive files.
Severity
The CVSS score of 7.5 reflects a high severity, primarily due to the vulnerability's high attack vector (Network), low attack complexity, no privileges required, and user interaction not required, coupled with a substantial impact on confidentiality (Complete).
Defender Context
Defenders should prioritize patching or implementing mitigating controls for Windmill instances to prevent unauthorized file access. This incident highlights the ongoing risks associated with unauthenticated path traversal vulnerabilities and the importance of regularly monitoring for active exploitation of known flaws.