Windmill is an open-source developer platform for internal code: APIs

Windmill's /api/w/{workspace}/jobs_u/get_log_file/{filename} endpoint concatenates the filename parameter directly into format!("{TMP_DIR}/logs/{file_p}") without sanitization. The jobs_u route prefix means no authentication is required. Any attacker who can reach the HTTP listener can walk out of /tmp/windmill with ..%2f sequences and read arbitrary files as the Windmill process user. Affected: v1.309.0 through v1.603.2; fixed in v1.603.3 (January 2026). The bundled Nextcloud Flow proxy (v1.0.0–v1.2.2) is reachable via a triple-encoded traversal (..%25252f) that survives httpx normalization — fixed in Flow v1.3.0.

The vendor's CVSS of 7.5 (C:H/I:N/A:N) treats this as a pure disclosure bug. That framing is wrong. Chocapikk's public *Windfall* exploit demonstrates the realistic chain: read /proc/1/environ to steal SUPERADMIN_SECRET, or read PostgreSQL heap files (base/{oid}/17149) to lift jwt_secret and forge an admin JWT, then POST to /api/w/{ws}/jobs/run/preview to execute bash/Python — and because most deployments mount /var/run/docker.sock, that job breaks the container and owns the host. Vendor-severity HIGH understates it; this is unauthenticated RCE with active exploitation confirmed by VulnCheck.

Why this verdict

• Vendor undersizing: The 7.5 score reflects only C:H/I:N/A:N. The publicly documented chain reaches I:H/A:H via forged super-admin JWT → /jobs/run/preview → root code execution. Baseline correction alone lifts this to 9.8.
• Active exploitation: VulnCheck telemetry (published July 2026) shows opportunistic scanning and successful reads of /etc/passwd and /proc/1/environ in the wild. Not KEV-listed yet, but that is a paperwork gap, not a threat-model gap.
• No auth, no user interaction, no chain to another vuln: A single HTTP GET reaches the primitive. Every prerequisite after that (SUPERADMIN_SECRET or PG heap read) is satisfied by the same primitive.
• Role multiplier — Windmill is a workflow/automation orchestrator (CI/CD-adjacent): Compromising it yields all stored connection credentials (S3, databases, cloud IAM, Slack tokens, git deploy keys) and the ability to inject code into scheduled jobs — supply-chain pivot into every system Windmill orchestrates. This is a canonical high-value role.
• Role multiplier — default /var/run/docker.sock mount: Fleet-scale host compromise from a single unauth GET on default Compose deployments. Kubernetes users escape only their pod but still own all Windmill-held secrets.
• Population caveat: ~170 internet-exposed instances is small — but Windmill's typical deployment sits behind an SSO proxy on internal networks, where any post-initial-access attacker (phished laptop, compromised VPN) trivially reaches it. Internal exposure vastly exceeds the 170 figure.

Why not higher?

There is no CRITICAL+ bucket. Score capped at 9.8 rather than 10.0 because Scope:Changed is arguable (worker container ≠ trust boundary in all deployments) and because the Kubernetes-without-socket configuration reduces the host-compromise step to a pod-scoped RCE.

Why not lower?

Downgrade to HIGH would require ignoring the public weaponized chain and the VulnCheck exploitation evidence — both of which are documented and current. The small internet-exposed population does not save internal-only deployments; a single phished workstation puts the attacker on the same network as the Windmill listener, at which point the chain runs unchanged.

1. Upgrade Windmill to ≥ v1.603.3 (Flow to ≥ v1.3.0) — The only durable fix. Sanitizes filename in get_log_file. Deploy within 3 days per noisgate CRITICAL mitigation SLA; complete rollout to all instances (including forgotten dev/staging) within 90 days per remediation SLA.
2. Block /api/w/*/jobs_u/get_log_file/* at the reverse proxy immediately — Add an Nginx/Traefik/Envoy location block returning 403 for that path pattern. Zero legitimate external consumers; log-fetch is UI-only. Deploy within hours — this is your temporary shield until the upgrade lands.
3. Rotate every secret Windmill has ever seen — Assume super-admin compromise for any instance exposed between v1.309.0 release and your patch time. Rotate SUPERADMIN_SECRET, jwt_secret, all workspace-stored resource credentials (S3, DB, cloud IAM, git deploy keys, webhook tokens). Complete within 7 days — attackers exfiltrate credentials silently and use them weeks later.
4. Remove /var/run/docker.sock mount from worker containers — Edit docker-compose.yml to drop the - /var/run/docker.sock:/var/run/docker.sock line unless a specific workflow requires Docker-in-Docker. Breaks the container-escape step of the chain. Deploy within 3 days.
5. Egress-filter Windmill worker nodes — Restrict outbound to the specific endpoints your workflows need (git, S3, internal APIs). Denies exfiltration and second-stage C2 even if RCE lands. Deploy within 30 days.
6. Audit /tmp/windmill/logs/ access logs for .. or %2e%2e or %252e — Grep the reverse-proxy access logs from 2026-01-01 forward for path-traversal indicators against jobs_u/get_log_file. Any hit = assume breach and pivot to IR. Do this today.

Run on an auditor workstation with curl installed against each Windmill URL you want to check. Invoke as ./check-cve-2026-29059.sh https://windmill.example.com. No credentials required — the check exploits the same unauth primitive to prove exposure. Safe read of /etc/hostname only.

#!/usr/bin/env bash
# noisgate verification for CVE-2026-29059 (Windmill unauth path traversal)
# Usage: ./check-cve-2026-29059.sh https://windmill.example.com
# Exit codes: 0=PATCHED  1=VULNERABLE  2=UNKNOWN
set -u

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <windmill-base-url>" >&2
  exit 2
fi
TARGET="${TARGET%/}"

# 1. Try to read /etc/hostname via the vulnerable endpoint. Any workspace name works.
PAYLOAD="..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fhostname"
URL="${TARGET}/api/w/noisgate-probe/jobs_u/get_log_file/${PAYLOAD}"

RESP=$(curl -sk --max-time 10 -o /tmp/nsg_body.$$ -w "%{http_code}" "$URL") || {
  echo "UNKNOWN: could not reach $TARGET"
  rm -f /tmp/nsg_body.$$
  exit 2
}

BODY=$(head -c 512 /tmp/nsg_body.$$ 2>/dev/null)
rm -f /tmp/nsg_body.$$

# A patched instance returns 400/403/404 or a sanitized error.
# A vulnerable instance returns 200 with the file contents (hostname is short alphanumeric).
if [[ "$RESP" == "200" ]] && [[ -n "$BODY" ]] && [[ ! "$BODY" =~ (error|not.found|invalid|sanitiz) ]] && [[ ${#BODY} -lt 256 ]]; then
  echo "VULNERABLE: $TARGET returned file contents via traversal"
  echo "  first-bytes: $(echo "$BODY" | tr -d '\n' | cut -c1-80)"
  exit 1
fi

# 2. Fallback: fingerprint version from /version endpoint
VER=$(curl -sk --max-time 10 "${TARGET}/api/version" 2>/dev/null | grep -oE '1\.[0-9]+\.[0-9]+' | head -1)
if [[ -n "$VER" ]]; then
  # Compare against 1.603.3
  IFS='.' read -r A B C <<<"$VER"
  if (( A > 1 )) || (( B > 603 )) || { (( B == 603 )) && (( C >= 3 )); }; then
    echo "PATCHED: $TARGET running Windmill $VER (>= 1.603.3)"
    exit 0
  else
    echo "VULNERABLE: $TARGET running Windmill $VER (< 1.603.3)"
    exit 1
  fi
fi

echo "UNKNOWN: $TARGET responded HTTP $RESP but no version banner and traversal probe inconclusive"
exit 2

Sources

1. VulnCheck / Hacker News — active exploitation report
2. Chocapikk — Windfall technical writeup (exploit chain)
3. Chocapikk/Windfall — public PoC repository
4. SentinelOne vulnerability database entry
5. OpenCVE — CVE-2026-29059 details
6. GBHackers coverage — RCE PoC published
7. OffSeq Threat Radar — CWE-22 classification