Critical Orkes Conductor Pre-Auth RCE (CVE-2026-58138) Actively Exploited in the Wild

Attackers are actively exploiting CVE-2026-58138 (CVSS 9.8), an unauthenticated remote code execution flaw in Orkes Conductor, by submitting malicious JavaScript or Python expressions in inline workflow definitions. The flaw was patched in Conductor 3.30.2 in…

CVE-2026-58138 (CVSS v3.1 9.8) is an unauthenticated remote code execution vulnerability in Orkes Conductor 3.21.21 before 3.30.2 (affected range per The Hacker News). A single unauthenticated POST to the open workflow API can register and start a malicious workflow containing hostile INLINE, LAMBDA, DO_WHILE, or SWITCH tasks whose JavaScript or Python expressions are evaluated by a GraalVM evaluator configured with HostAccess.ALL (allowAllAccess(true)), which removes sandboxing and lets attacker code reflect into Java and execute OS commands, often as root. The flaw was patched in Conductor 3.30.2 in June, PoC code appeared in early August, and exploitation followed: Empirical Security identified in-the-wild attacks on August 21, while The Hacker News reports that Previdian and Empirical Security observed exploitation since July 24, 2026 — the sources differ on the start date. Fortinet issued an outbreak alert on the ongoing exploitation, reporting it blocked 1,290 attempts in 24 hours as of September 9, 2026 (roughly 1,300 between September 8 and 9 per SecurityWeek) and nearly 7,000 attempts between September 2 and 9, a 132% daily increase, with most activity from Germany, Hong Kong, Indonesia, the U.A.E., and India. Defenders should patch to 3.30.2, restrict or firewall workflow API access if patching is delayed, and monitor for suspicious workflow submissions.

• Vulnerability: CVE-2026-58138, unauthenticated RCE in Orkes Conductor, CVSS v3.1 9.8
• Affected versions: Orkes Conductor 3.21.21 before 3.30.2 (per The Hacker News); fixed in 3.30.2, released June per SecurityWeek
• Attack vector: a single unauthenticated POST to the open workflow API registers and starts a malicious workflow with hostile JavaScript or Python expressions in INLINE, LAMBDA, DO_WHILE, or SWITCH tasks
• Root cause: GraalVM evaluator runs with HostAccess.ALL / allowAllAccess(true), disabling the sandbox so attacker code reflects into Java and executes OS commands, often as root
• Timeline: patched in 3.30.2 in June; PoC code appeared in early August; Empirical Security identified in-the-wild attacks on August 21 (SecurityWeek), while The Hacker News reports Previdian and Empirical Security observed exploitation…
• Scale: Fortinet blocked 1,290 attempts in 24 hours as of September 9, 2026 (roughly 1,300 between September 8 and 9 per SecurityWeek) and nearly 7,000 attempts between September 2 and 9; a 132% daily increase in attacks
• Top source countries of attack activity: Germany, Hong Kong, Indonesia, the U.A.E., and India
• Mitigations: patch to Conductor 3.30.2; firewall or restrict workflow API access if patching is delayed; monitor for suspicious workflow submissions