VulnCheck Reports Active Exploitation of Windmill File-Read Flaw
Summary
VulnCheck reports active exploitation of Windmill CVE-2026-29059, an unauthenticated path-traversal flaw enabling arbitrary file reads. CISA added four exploited flaws to KEV; the article also details WordPress and Langflow attack activity.
Key points
- VulnCheck reports active exploitation of Windmill CVE-2026-29059, which allows unauthenticated path traversal through the get_log_file endpoint to read server files.
- Reported attempts targeted files including /etc/passwd; access to /proc/1/environ could expose SUPERADMIN_SECRET and enable superadmin access and code execution when that secret is configured.
- Windmill fixed the flaw in version 1.603.3. VulnCheck identified about 170 exposed vulnerable systems across 24 countries.
- CISA added four flaws to its KEV catalog: WordPress WP2Shell vulnerabilities CVE-2026-60137 and CVE-2026-63030, DD-WRT CVE-2021-27137, and Langflow CVE-2026-0770.
- Wordfence reported exploitation attempts against WordPress involving REST API route confusion and unauthenticated SQL injection; VulnCheck said it verified more than two dozen WP2Shell proof-of-concept exploits.
- KEVIntel reported 137 Langflow exploitation attempts from 46 attacker IP addresses since June 27, including payloads seeking credentials and attempting malware downloads and execution.
- Federal civilian agencies were advised to remediate the identified flaws by July 24, 2026.
Article Details
- Vulnerability Types
- Unauthenticated path traversal allowing arbitrary file reads
- Severity
- High (CVSS 7.5)
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1005 · Data from Local SystemObserved exploitation attempts sought local files including /etc/passwd, environment variables, and AWS credentials.T1059.004 · Unix ShellLangflow exploitation attempts included executing shell scripts to install second-stage payloads.T1105 · Ingress Tool TransferLangflow exploitation attempts used wget or curl to download malware.T1190 · Exploit Public-Facing ApplicationAttackers are actively exploiting exposed Windmill, WordPress, and Langflow application vulnerabilities.
CVE
CVE-2026-0770CISA has also added multiple flaws to its KEV catalog, while exploitation activity is surging against WordPress wp2shell and Langflow CVE-2026-0770.CVE-2026-29059VulnCheck says CVE-2026-29059 in Windmill is being actively exploited to abuse the get_log_file endpoint for arbitrary file reads, with attackers trying to access sensitive data such as /etc/passwd and, in some cases,CVE-2026-60137its Known Exploited Vulnerabilities (KEV) catalog, including two WordPress bugs tracked as wp2shell (CVE-2026-60137 and CVE-2026-63030), along with a stack-based buffer overflow in DD-WRT (CVE-2021-27137) and anCVE-2026-63030Vulnerabilities (KEV) catalog, including two WordPress bugs tracked as wp2shell (CVE-2026-60137 and CVE-2026-63030), along with a stack-based buffer overflow in DD-WRT (CVE-2021-27137) and an unauthenticated remote
People
Caitlin CondonVulnCheck vice president of security research who reported observed exploitation against direct Windmill endpoints and a Nextcloud proxy path.Ryan DewhurstKEVIntel representative who reported detecting in-the-wild exploitation attempts targeting CVE-2026-0770.Valentin LobsteinVulnCheck security researcher credited with discovering and reporting CVE-2026-29059.
Products
DD-WRTCISA added Windmill-adjacent active threats, including wp2shell, DD-WRT CVE-2021-27137, and Langflow CVE-2026-0770, to its KEV catalog.LangflowCISA has also added multiple flaws to its KEV catalog, while exploitation activity is surging against WordPress wp2shell and Langflow CVE-2026-0770.WindmillVulnCheck says CVE-2026-29059 in Windmill is being actively exploited to abuse the get_log_file endpoint for arbitrary file reads, with attackers trying to access sensitive data such as /etc/passwd and, in some cases,WordPressCISA has also added multiple flaws to its KEV catalog, while exploitation activity is surging against WordPress wp2shell and Langflow CVE-2026-0770.