- Engineer — Act: Active in-the-wild exploitation confirmed by VulnCheck and a public PoC is available; if you self-host Windmill, patch immediately and audit web server logs for unauthenticated requests to the
/api/w/{workspace}/jobs_u/get_log_file/ endpoint containing traversal sequences. - SOC/IR — Act: Active exploitation with public PoC means opportunistic scanning is already underway; hunt web proxy and WAF logs for path traversal patterns (e.g.,
../) in requests to Windmill’s get_log_file endpoint, and sweep for unusual file reads on any Windmill hosts since the PoC dropped. - Leader — Skip
- Signals: CVE-2026-29059 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub