Critical Unauthenticated RCE Vulnerability Actively Exploited in Orkes Conductor
Attackers bypass authentication to execute system commands via workflow API
1Critical vulnerability details
CVE-2026-58138 (CVSS v3.1: 9.8) allows unauthenticated attackers to execute arbitrary OS commands on Orkes Conductor versions before 3.30.2. The flaw exists in workflow API endpoints that process inline definitions containing malicious JavaScript/Python expressions. Attackers bypass authentication entirely, making this particularly dangerous for exposed instances.
2Exploitation mechanism
The vulnerability stems from improperly configured GraalVM evaluators with HostAccess.ALL privileges. Attackers leverage INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke Java reflection or direct subprocess calls. This allows escaping the scripting sandbox to execute system commands with Conductor process privileges, effectively giving full server control.
3Active attack patterns
Fortinet observed 1,290 attack attempts blocked in 24 hours (132% daily increase) by September 9, 2026, with nearly 7,000 total attempts between September 2-9. Primary attack sources include Germany, Hong Kong, Indonesia, UAE, and India. Previdian's honeypots recorded exploitation attempts from French and US IPs since July 2026.
4Vulnerable components
The flaw specifically impacts workflow API endpoints accepting inline task definitions. Systems using default GraalVM evaluator configurations with allowAllAccess(true) are most at risk. Any Conductor instance below version 3.30.2 that exposes workflow APIs to external networks should be considered compromised until patched.
5Current mitigation strategies
Orkes released version 3.30.2 to address the vulnerability. For organizations unable to patch immediately, security teams should restrict external API access, implement network controls around Conductor instances, and monitor for suspicious workflow submissions. Special attention should be given to unexpected command execution logs.
6Attack detection challenges
The exploitation leaves minimal traces since it uses legitimate API pathways. Defenders must scrutinize workflow submissions containing JavaScript/Python expressions, especially those attempting Java reflection calls. Empirical Security confirmed active exploitation continuing through August 2026, suggesting prolonged attacker interest.
7Broader implications
This vulnerability highlights risks in workflow automation platforms that combine multiple scripting engines. The GraalVM integration specifically creates attack surfaces when configured permissively. Similar platforms using polyglot execution environments should audit their sandboxing implementations and host access controls.
8Prioritization urgency
With active exploitation delivering full system compromise, this vulnerability warrants immediate attention. The 9.8 CVSS score reflects both low attack complexity and high impact. Organizations should treat unpatched Conductor instances as critically exposed, particularly those handling sensitive data or business-critical workflows.