A high-severity security flaw impacting the open-source developer platform **Windmill** (**CVE-2026-29059**) is under active exploitation, according to **VulnCheck**. The vulnerability, with a CVSS score of 7.5, is an unauthenticated path traversal affecting Windmill's `get_log_file` endpoint (`/api/w/{workspace}/jobs_u/get_log_file/{filename}`).  ### How the Windmill Flaw Works As detailed in an advisory published by **Windmill** in March 2026, the `filename` parameter is concatenated into a file path without proper sanitization. This oversight allows an attacker to use `../` sequences to read arbitrary files on the server. Crucially, if the `SUPERADMIN_SECRET` environment variable is set, this vulnerability can be leveraged to read it via `/proc/1/environ`. The secret can then be used as a Bearer token to authenticate as a superadmin and execute arbitrary code through the job preview API. However, it's important to note that `SUPERADMIN_SECRET` is not set by default. For standalone **Windmill** instances without this configuration, the impact is limited to arbitrary file reading. ### Remediation and Exploitation Details The issue has been addressed in **Windmill** version 1.603.3, released in January 2026, by implementing sanitization checks for the filename parameter. **VulnCheck** security researcher Valentin Lobstein is credited with discovering and reporting the flaw. **VulnCheck** has observed exploitation attempts targeting the `get_log_file` endpoint to extract sensitive information, such as the contents of `/etc/passwd`. Caitlin Condon, Vice President of Security Research at **VulnCheck**, stated on LinkedIn, "We've observed exploits aimed at both direct Windmill endpoints and the Nextcloud proxy path." The cybersecurity company has identified approximately 170 vulnerable **Windmill** systems exposed across 24 countries. ### Broader Vulnerability Landscape This disclosure comes as the **U.S. Cybersecurity and Infrastructure Security Agency (CISA)** added four new security flaws to its Known Exploited Vulnerabilities (**KEV**) catalog. Among these are two **WordPress** bugs, collectively known as 'wp2shell' (**CVE-2026-60137** and **CVE-2026-63030**), a stack-based buffer overflow in **DD-WRT** (**CVE-2021-27137**), and an unauthenticated remote code execution issue in **Langflow** (**CVE-2026-0770**). **Wordfence** described 'wp2shell' as "one of the most significant WordPress Core security events in recent years." The combination of unauthenticated reachability, no plugin or theme requirement, a large global attack surface, a path to administrator access and code execution, and public proof-of-concept (PoC) exploit availability makes this vulnerability chain particularly serious. **Wordfence** data shows threat actors are exploiting REST API batch request route-confusion and unauthenticated SQL injection to achieve code execution. **VulnCheck** verified over two dozen unique PoC exploits targeting 'wp2shell' as of July 19, 2026, urging users to update **WordPress** immediately. Regarding **CVE-2026-0770** in **Langflow**, KEVIntel's Ryan Dewhurst reported that in-the-wild attacks were first detected on June 27, 2026. Since then, 137 exploitation attempts have been recorded from 46 unique attacker IP addresses across 17 countries. Observed payloads include command execution checks, attempts to extract `/etc/passwd` or AWS credentials, environment variable collection, malware downloads via `wget` or `curl`, and shell script execution for second-stage payloads. Federal Civilian Executive Branch (**FCEB**) agencies are advised to remediate these identified flaws by July 24, 2026.