Critical Orkes Conductor Vulnerability Exploited in Attacks
A critical unauthenticated remote code execution vulnerability, CVE-2026-58138, in Orkes Conductor is being actively exploited by attackers.
A critical-severity vulnerability in Orkes Conductor, allowing exploitation without authentication, has been actively targeted by attackers for at least a month. Orkes Conductor is an open-source unified enterprise framework designed to help organizations orchestrate microservices, workflows, and AI agents.
Tracked as CVE-2026-58138, the vulnerability carries a CVSS score of 9.8 and is classified as a remote code execution (RCE) issue. Attackers can exploit this flaw by submitting malicious inline workflow definitions to the workflow API endpoint. This method allows for arbitrary code execution on affected Conductor instances, posing a significant threat to system integrity.
The vulnerability arises from how Conductor processes scripts within a workflow. Specifically, inline tasks, as well as LAMBDA, DO_WHILE, and SWITCH tasks, evaluate user-supplied JavaScript or Python expressions. This evaluation occurs within a GraalVM context configured with HostAccess.ALL, which effectively disables sandboxing. Consequently, attacker-supplied code can directly interact with the Java runtime, enabling the execution of OS commands with the privileges of the Conductor process, which often runs with root access.
A critical aspect of this vulnerability is the lack of default authentication in the open-source Conductor server. This leaves its workflow API exposed to the internet, allowing any unauthenticated attacker to register a malicious workflow and initiate its execution with a single POST request. This ease of access significantly broadens the attack surface.
While CVE-2026-58138 was patched in version 3.30.2 of Orkes Conductor in June, proof-of-concept (PoC) code emerged in early August, leading to exploitation shortly thereafter. Empirical Security first identified in-the-wild attacks on August 21. More recently, Fortinet reported blocking approximately 1,300 exploitation attempts between September 8 and 9, highlighting the ongoing and widespread nature of these attacks.
To mitigate this risk, organizations are strongly advised to update their Orkes Conductor instances to version 3.30.2 or later. Additionally, restricting external access to Conductor's workflow API endpoints is crucial. Deployments should be situated behind firewalls, and services should not be directly exposed to the public internet.
Security teams should also implement robust monitoring for suspicious workflow submissions and unauthorized command execution on their Conductor instances. A thorough review of systems running vulnerable versions for any signs of intrusion or compromise is also recommended to detect and address any potential breaches.
The active exploitation of CVE-2026-58138 underscores the persistent threat posed by unauthenticated RCE vulnerabilities in widely used open-source software. Prompt patching and diligent security hygiene are essential to protect against such attacks.