Critical Orkes Conductor Vulnerability Exploited in Attacks
Attackers actively exploit CVE-2026-58138 (CVSS 9.8), an unauthenticated RCE in Orkes Conductor via malicious JavaScript or Python expressions in inline workflows.
CVE-2026-58138 lets unauthenticated attackers submit workflow definitions containing hostile INLINE, LAMBDA, DO_WHILE, or SWITCH tasks; the GraalVM evaluator runs with HostAccess.ALL, disabling the sandbox so attacker code reflects into Java and executes OS commands, often as root. The flaw was patched in Conductor 3.30.2 in June, PoC code appeared in early August, and Empirical Security identified in-the-wild attacks on August 21. Fortinet blocked roughly 1,300 exploitation attempts between September 8 and 9 and issued an outbreak alert on the ongoing exploitation.
- A single unauthenticated POST to the open workflow API registers and starts a malicious workflow
- GraalVM HostAccess.ALL removes sandboxing; reflected Java calls run OS commands as root
- Patched in 3.30.2 (June); PoC in early August; attacks observed since August 21
- Defenders should firewall workflow APIs and monitor for suspicious workflow submissions
- CVEs
- CVE-2026-58138
- Products
- Orkes Conductor
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-58138 | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS… | 9.3 | 9% | PoC |
From the original article
2 min read at securityweek.com
CVE-2026-58138 is an unauthenticated remote code execution vulnerability that attackers can exploit via inline workflow definitions. The post Critical Orkes Conductor Vulnerability Exploited in Attacks appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.