Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organizations using Windmill developer platform
Incident: Active exploitation of CVE-2026-29059 involving unauthenticated path traversal.
Impact: Arbitrary file read and potential remote code execution via superadmin privilege escalation.
Attacker: Unidentified threat actors
Analysis: Attackers are exploiting an unsanitized filename parameter in Windmill’s log retrieval endpoint to perform path traversal attacks. While the primary impact is arbitrary file read, the exposure of the SUPERADMIN_SECRET environment variable can be escalated to remote code execution. Research indicates approximately 170 vulnerable systems across 24 countries have already been targeted.
Recommendations: Update Windmill installations to version 1.603.3 or newer immediately.; Review environment configurations to ensure SUPERADMIN_SECRET is not unnecessarily exposed.; Monitor API logs for suspicious path traversal sequences like ‘../’ targeting the get_log_file endpoint.
Source: The Hacker News
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source