Windmill Path Traversal CVE-2026-29059 Exploited in the Wild

Thu, 23 Jul 2026 12:47:45 +0000

Engineer — Act: Active in-the-wild exploitation confirmed by VulnCheck and a public PoC is available; if you self-host Windmill, patch immediately and audit web server logs for unauthenticated requests to the /api/w/{workspace}/jobs_u/get_log_file/ endpoint containing traversal sequences.
SOC/IR — Act: Active exploitation with public PoC means opportunistic scanning is already underway; hunt web proxy and WAF logs for path traversal patterns (e.g., ../) in requests to Windmill’s get_log_file endpoint, and sweep for unusual file reads on any Windmill hosts since the PoC dropped.
Leader — Skip
Signals: CVE-2026-29059 — CISA KEV: not listed, EPSS 0.03, public PoC on GitHub

Developer-Platform on CuraSec