Ethical Hacking News
Hackers have exploited a high-severity vulnerability in the open-source developer platform Windmill to read arbitrary server files without authentication. The identified flaw, CVE-2026-29059, has been actively targeted by threat actors across 24 countries.
Vulnerability CVE-2026-29059 in Windmill discovered and actively exploited by hackers. High-severity security flaw with a CVSS score of 7.5, allowing arbitrary file reads without authentication. SUPERADMIN_SECRET environment variable exposed, enabling superadmin authentication and code execution. Patch released in Windmill version 1.603.3, but exploitation efforts continue. Over 170 vulnerable systems exposed across 24 countries. Threat actors using exploit to achieve code execution, extract sensitive info, and download malware.
A recent vulnerability discovered in the open-source developer platform, Windmill, has been actively exploited by hackers in the wild. The vulnerability, identified as CVE-2026-29059, has a CVSS score of 7.5, categorizing it as a high-severity security flaw. This issue allows attackers to read arbitrary files on servers without authentication via the "get_log_file" endpoint.
The primary sensitive value exposed by this vulnerability is the SUPERADMIN_SECRET environment variable, which can be used as a Bearer token to authenticate as a superadmin and execute arbitrary code through the job preview API. However, it's worth noting that the SUPERADMIN_SECRET is not set by default for standalone Windmill instances without SUPERADMIN_SECRET configured, thus limiting its impact.
In March 2026, Windmill released version 1.603.3, which addressed this vulnerability by adding sanitization checks to the filename parameter to prevent directory traversal. Despite this patch, exploitation efforts have been directed against Windmill's "get_log_file" endpoint and Nextcloud proxy path, with identified attacks targeting both direct Windmill endpoints and the Nextcloud proxy path.
According to VulnCheck, who credited security researcher Valentin Lobstein for discovering and reporting the flaw, more than 170 vulnerable systems were exposed across 24 countries. Caitlin Condon, vice president of security research at VulnCheck, mentioned that they've observed exploits aimed at both direct Windmill endpoints and the Nextcloud proxy path.
The vulnerability was added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), along with other security flaws including two WordPress bugs tracked as wp2shell, a stack-based buffer overflow in DD-WRT, and an unauthenticated remote code execution issue in Langflow.
The impact of this vulnerability is significant, especially considering its widespread exposure across various countries. Threat actors have been observed using the exploit to achieve code execution, extract sensitive information, access AWS credentials, environment variables, and download malware. Experts advise federal civilian executive branch agencies to remediate the identified flaws by July 24, 2026.
Furthermore, another notable vulnerability was discovered in WordPress - wp2shell, which has received significant attention due to its severity and reachability. The combination of unauthenticated reachability, no plugin or theme requirement, a large global attack surface, a path to administrator access, and code execution makes this vulnerability unusually serious. Threat actors are issuing requests to exploit the REST API batch request route-confusion issue and an unauthenticated SQL injection to achieve code execution.
The discovery of these vulnerabilities highlights the importance of regularly updating software, especially open-source platforms like Windmill, to address newly discovered security flaws. It also underscores the need for vigilance in cybersecurity measures, as attackers continue to exploit weaknesses in various systems to gain unauthorized access to sensitive information.
Related Information:
https://www.ethicalhackingnews.com/articles/Hackers-Exploit-Windmill-Flaw-to-Read-Arbitrary-Server-Files-Without-Authentication-ehn.shtml
https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html
https://nvd.nist.gov/vuln/detail/CVE-2026-29059
https://www.cvedetails.com/cve/CVE-2026-29059/
Published: Wed Jul 22 11:20:14 2026 by llama3.2 3B Q4_K_M
