Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-27137 | Unauthenticated Stack-Based Buffer Overflow in DD-WRT UPnP (SSDP M-SEARCH) DD-WRT firmware before build 45724 contains a stack-based buffer overflow (CWE-121) caused by an unsafe strcpy in the UPnP handling code (ssdp_msearch in router/upnp/src/ssdp.c). An unauthenticated remote attacker can trigger it by sending a crafted SSDP M-SEARCH request to a UPnP-enabled interface, overflowing an internal fixed buffer. Successful exploitation can crash the router or allow code execution and full device compromise, consistent with the high confidentiality, integrity and availability impacts in the 8.1 CVSS score. Exposure is limited because UPnP is disabled by default and, by default, listens only on internal interfaces, so risk is concentrated on DD-WRT routers where UPnP has been enabled and on networks where an attacker has LAN access. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-21, has public proofs of concept, and is reportedly being exploited in the wild by the C0XMO IoT botnet (a Gafgyt variant) to propagate and remove rival malware. Do: Upgrade affected DD-WRT routers to build 45724 or later. If upgrading is not immediately possible, disable UPnP, or verify that UPnP/SSDP is bound only to internal interfaces and that UDP port 1900 (SSDP) and M-SEARCH traffic are not reachable from the WAN. Per the CISA KEV required action, apply mitigations in line with BOD 26-04 guidance, and check any internet-exposed DD-WRT device for signs of compromise (e.g., unexpected botnet traffic) if UPnP was enabled. | 8.1 | 4% | KEV PoC ×4 |
| large≈ hundreds of thousands of DD-WRT routers, of which only the subset with UPnP enabled is actually exploitable | |
| CVE-2026-0770 | Unauthenticated Remote Code Execution in Langflow validate Endpoint CVE-2026-0770 is an unauthenticated remote code execution vulnerability in Langflow, an open-source visual builder for LLM and AI agent workflows. The flaw, categorized as CWE-829 (inclusion of functionality from an untrusted control sphere), resides in how the exec_globals parameter supplied to the validate endpoint is handled, allowing code or resources from an untrusted control sphere to be included and executed. A remote attacker with no credentials can send a crafted request to that endpoint and execute arbitrary code in the context of root on the affected installation. Any deployment of an affected Langflow version is exposed, with internet-facing self-hosted or containerized instances at greatest risk. The issue was disclosed through Trend Micro's Zero Day Initiative (ZDI-CAN-27325) and was added to CISA's Known Exploited Vulnerabilities catalog on 2026-07-21, confirming active in-the-wild exploitation; no public proof-of-concept is known. Do: Apply the vendor's patched Langflow release and any prescribed mitigations per CISA guidance; because exploitation requires no authentication and executes as root, prioritize internet-exposed instances immediately (EPSS is high at 63.4%). Per BOD 26-04, if mitigations or updates are unavailable for a given deployment, discontinue use of the product. Review access logs for unexpected unauthenticated requests to the validate endpoint containing crafted exec_globals parameters, and restrict network exposure of Langflow instances until patched. | 9.8 | 63% | KEV |
| moderate≈10,000–100,000 deployments (estimate; no official install count available) | |
| CVE-2026-29059 | Windmill is an open-source developer platform for internal code: Windmill is an open-source developer platform for internal code: APIs, background jobs, workflows and UIs. Prior to version 1.603.3, an unauthenticated path traversal vulnerability exists in Windmill's get_log_file endpoint "(/api/w/{workspace}/jobs_u/get_log_file/{filename})". The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences. This issue has been patched in version 1.603.3. NVD description · AI analysis pending | 6.9 | 3% |
| — | ||
| CVE-2026-63030 +1 in the same advisory: …60137 | WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE WordPress Core contains an interpretation-conflict flaw (CWE-436) in the REST API batch endpoint that causes route confusion, allowing requests to be dispatched to an unintended route. When chained with the author__not_in WP_Query SQL injection (CVE-2026-60137), this allows a remote, unauthenticated attacker to inject SQL and escalate to remote code execution. Any WordPress site running 6.9.x before 6.9.5 or 7.0.x before 7.0.2 is affected, with no privileges or user interaction required (CVSS 3.1: 9.8). Exploitation is confirmed in the wild: the issue was added to CISA's KEV on 2026-07-21, EPSS is 97.3% (100th percentile), and a public PoC is reportedly fueling mass scanning under the 'wp2shell' label. Do: Upgrade immediately to WordPress 6.9.5 (for 6.9.x) or 7.0.2 (for 7.0.x), or later, which fixes both this flaw and the chained SQL injection CVE-2026-60137; prioritize internet-facing sites because exploitation is unauthenticated and being mass-scanned. Review web and REST API logs for suspicious batch requests, SQL errors, unexpected admin users, or modified files. Organizations in scope for CISA BOD 26-04 must apply the required mitigations per vendor instructions or discontinue use. | 9.8 group max | 97% | KEV PoC |
| massest. hundreds of thousands to millions of WordPress sites (core runs roughly 40% of the web; only unpatched 6.9.x/7.0.x instances remain exploitable) |
Full article634 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 22, 2026Vulnerability / Web Security
A high-severity security flaw impacting open-source developer platform Windmill has come under active exploitation in the wild, per VulnCheck.
The vulnerability in question is CVE-2026-29059 (CVSS score: 7.5), a case of unauthenticated path traversal impacting Windmill's "get_log_file" endpoint ("/api/w/{workspace}/jobs_u/get_log_file/{filename}").
"The filename parameter is concatenated into a file path without sanitization, allowing an attacker to read arbitrary files on the server using ../ sequences," according to an advisory published by Windmill in March 2026.
"The primary sensitive value exposed by this vulnerability is the SUPERADMIN_SECRET environment variable, readable via /proc/1/environ. When set, this secret can be used as a Bearer token to authenticate as a superadmin and execute arbitrary code through the job preview API."
However, it's worth noting that SUPERADMIN_SECRET is not set by default, and for standalone Windmill instances without SUPERADMIN_SECRET configured, the impact of the vulnerability is limited to arbitrary file read. The issue has since been addressed in Windmill 1.603.3, released in January 2026, by adding sanitization checks to the filename parameter to prevent directory traversal.
According to VulnCheck, whose security researcher Valentin Lobstein is credited with discovering and reporting the flaw, exploitation efforts have been directed against Windmill's "get_log_file" endpoint to extract sensitive information from the "/etc/passwd" file.
"We've observed exploits aimed at both direct Windmill endpoints and the Nextcloud proxy path," Caitlin Condon, vice president of security research at VulnCheck, said in a post on LinkedIn.
The cybersecurity company said it identified about 170 vulnerable systems exposed across 24 countries.
The disclosure comes as the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four security flaws to its Known Exploited Vulnerabilities (KEV) catalog, including two WordPress bugs tracked as wp2shell (CVE-2026-60137 and CVE-2026-63030), along with a stack-based buffer overflow in DD-WRT (CVE-2021-27137) and an unauthenticated remote code execution issue in Langflow (CVE-2026-0770).
"wp2shell is one of the most significant WordPress Core security events in recent years," Wordfence said. "The combination of unauthenticated reachability, no plugin or theme requirement, a large global attack surface, a path to administrator access and code execution, as well as public proof-of-concept exploit availability makes this vulnerability chain unusually serious."
Attack data captured by the WordPress security company shows that threat actors are issuing requests to exploit the REST API batch request route-confusion issue and an unauthenticated SQL injection to achieve code execution.
VulnCheck also said it had verified more than two-dozen unique PoC exploits targeting WP2Shell as of July 19, 2026. "Affected users should update to a fixed version of WordPress as soon as possible, given the overwhelming likelihood that various public exploits and large-scale exploitation will follow the high-profile disclosure," it added.
As for CVE-2026-0770, KEVIntel's Ryan Dewhurst told The Hacker News that first in-the-wild attack efforts targeting the flaw were detected against its sensors on June 27, 2026, recording 137 exploitation attempts from 46 unique attacker IP addresses associated with 17 countries since then.
No less than 75 attempts, which account for more than half of the activity, originated from 20 attacker IP addresses during the last seven days. Observed payloads include base command execution checks, attempts to extract the contents of "/etc/passwd" or access AWS credentials, environment variable collection, malware downloads using wget or curl, and shell script execution to install second-stage payloads.
"The activity is not limited to vulnerability checks," Dewhurst said. "While much of it involved commands such as id, whoami and reading /etc/passwd, we also observed payloads attempting to download malware and obtain environment variables, AWS credentials and container metadata."
Federal Civilian Executive Branch (FCEB) agencies are advised to remediate the identified flaws by July 24, 2026.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/07/hackers-exploit-windmill-flaw-to-read.html