Critical Orkes Conductor Vulnerability Exploited in Attacks
Attackers actively exploit CVE-2026-58138 (CVSS 9.8), an unauthenticated RCE in Orkes Conductor via malicious JavaScript or Python expressions in inline workflows.
CVE-2026-58138 lets unauthenticated attackers submit workflow definitions containing hostile INLINE, LAMBDA, DO_WHILE, or SWITCH tasks; the GraalVM evaluator runs with HostAccess.ALL, disabling the sandbox so attacker code reflects into Java and executes OS commands, often as root. The flaw was patched in Conductor 3.30.2 in June, PoC code appeared in early August, and Empirical Security identified in-the-wild attacks on August 21. Fortinet blocked roughly 1,300 exploitation attempts between September 8 and 9 and issued an outbreak alert on the ongoing exploitation.
- A single unauthenticated POST to the open workflow API registers and starts a malicious workflow
- GraalVM HostAccess.ALL removes sandboxing; reflected Java calls run OS commands as root
- Patched in 3.30.2 (June); PoC in early August; attacks observed since August 21
- Defenders should firewall workflow APIs and monitor for suspicious workflow submissions
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-58138 | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS comma Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls. NVD description · AI analysis pending | 9.3 | 9% | — | — |
Full article355 words · extracted from securityweek.com · click to collapse
A critical-severity vulnerability in Orkes Conductor that can be exploited without authentication has been in attackers’ crosshairs for at least a month.
Conductor is an open source unified enterprise framework that allows organizations to orchestrate microservices, workflows, and AI agents.
Tracked as CVE-2026-58138 (CVSS score of 9.8), the critical bug is described as a remote code execution issue exploitable via inline workflow definitions submitted to the workflow API endpoint.
Attackers can include malicious JavaScript or Python expressions in the definitions to invoke arbitrary system commands. The flaw affects how Conductor runs scripts inside a workflow.
“An INLINE task (and LAMBDA, DO_WHILE, and SWITCH tasks) evaluates a user-supplied JavaScript or Python expression, and Conductor builds that evaluator on a GraalVM context configured with HostAccess.ALL,” Empirical Security explains.
This configuration disables the sandbox, and the attacker-supplied code reflects into the Java runtime and executes OS commands as the Conductor process, which often runs with root privileges.
Advertisement. Scroll to continue reading.
“No login stands in the way, because the open-source server enforces no authentication by default and leaves its workflow API open. A single unauthenticated POST registers a workflow with a hostile INLINE task and starts it,” Empirical notes.
CVE-2026-58138 was patched in June in Orkes Conductor version 3.30.2. Proof-of-concept (PoC) code targeting it was published in early August, and exploitation started shortly after.
Empirical identified in-the-wild attacks on August 21, and Fortinet blocked roughly 1,300 exploitation attempts between September 8 and 9. This week, Fortinet released an outbreak alert on the vulnerability’s ongoing exploitation.
In addition to updating to Conductor 3.30.2 or later, organizations should restrict external access to Conductor’s workflow API endpoints and ensure Conductor deployments are behind a firewall and that their services are not directly exposed to the internet.
They should also monitor their instances for suspicious workflow submissions and unauthorized command execution, and review systems running vulnerable versions for signs of intrusion.
Related: Check Point, Kaspersky, Tanium Patch Product Vulnerabilities
Related: CISA Retires Weekly Vulnerability Bulletin in Risk-Based Pivot
Related: ISC Patches 14 Vulnerabilities in BIND 9 Security Update
Related: Cisco Fixes Dozens of Flaws Across FMC, ISE and Nexus Dashboard
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.securityweek.com/critical-orkes-conductor-vulnerability-exploited-in-attacks/