Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

A security flaw in the Windmill open-source developer platform is being actively exploited, allowing hackers to read arbitrary server files without authentication. The vulnerability, identified as CVE-2026-29059, has a CVSS score of 7.5 and is classified as a case of unauthenticated path traversal. It affects the "get_log_file" endpoint, specifically the filename parameter, which is concatenated into a path. This enables attackers to access files on the server. The vulnerability is considered high-severity due to its potential impact.