CVE-2026-29059: Windmill: SUPERADMIN_SECRET (rarely used) can be accessed publicly
Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's getlogfile endpoint "(/api/w/{workspace}/jobsu/getlogfile/{filename})". The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences. This issue has been patched in version 1.603.3.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-29059?
CVE-2026-29059 is classified as a high severity vulnerability due to public access to sensitive information.
How do I fix CVE-2026-29059?
To remediate CVE-2026-29059, upgrade Windmill to version 1.603.3 or later.
What kind of vulnerability is CVE-2026-29059?
CVE-2026-29059 is a path traversal vulnerability that allows unauthorized access to log files.
Which versions of Windmill are affected by CVE-2026-29059?
Windmill versions prior to 1.603.3 are affected by CVE-2026-29059.
Can CVE-2026-29059 be exploited remotely?
Yes, CVE-2026-29059 can be exploited remotely due to its unauthenticated access nature.