An active exploitation campaign targeting an open-source developer platform has been uncovered, allowing unauthenticated network actors to read arbitrary system files. The vulnerability stems from an unsanitized file path concatenation flaw within diagnostic API endpoints.
The vulnerability, tracked as CVE-2026-29059, affects the Windmill developer automation suite. Threat monitoring data shows automated scanning loops targeting the get_log_file API endpoint. By submitting directory traversal sequences within the filename parameter, attackers can read sensitive system files including /proc/1/environ. This exposes the SUPERADMIN_SECRET environment variable, which attackers then convert into bearer authentication tokens to execute arbitrary code via job preview endpoints.
Exposing core platform environment variables to unauthenticated internet queries breaks application isolation parameters. Once a threat actor acquires superadministrator secrets from developer orchestration engines, they can modify automated background jobs, access integrated database credentials, and pivot laterally into corporate deployment pipelines.
– Update all active Windmill application instances to version 1.418.0 or later to apply input sanitization fixes.
– Audit server environment variable access logs to verify if SUPERADMIN_SECRET tokens were queried prior to patching.
– Rotate all administrative bearer tokens and database connection strings managed within the developer platform workspace.
– Enforce strict perimeter firewalls to restrict public internet routing access to internal developer tools.
Developer pipeline security relies on strict input parameter sanitization combined with immediate token rotation to ensure internal orchestration platforms do not function as initial access channels. #CodeDefence #Windmill #PathTraversal #AppSec #DevOps #VulnerabilityManagement
/
