# Critical Unauthenticated RCE Vulnerability Actively Exploited in Orkes Conductor

Attackers bypass authentication to execute system commands via workflow API

- **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563)
- **Published:** 2026-09-19
- **Topic:** [Software & Engineering](https://brifing.si/c/engineering)
- **Original article:** <https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html>
- **On Brifing:** https://brifing.si/s/16c236a0-5898-4bb9-865a-e4f264542c20

## Critical vulnerability details

CVE-2026-58138 (CVSS v3.1: 9.8) allows unauthenticated attackers to execute arbitrary OS commands on Orkes Conductor versions before 3.30.2. The flaw exists in workflow API endpoints that process inline definitions containing malicious JavaScript/Python expressions. Attackers bypass authentication entirely, making this particularly dangerous for exposed instances.

## Exploitation mechanism

The vulnerability stems from improperly configured GraalVM evaluators with HostAccess.ALL privileges. Attackers leverage INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke Java reflection or direct subprocess calls. This allows escaping the scripting sandbox to execute system commands with Conductor process privileges, effectively giving full server control.

## Active attack patterns

Fortinet observed 1,290 attack attempts blocked in 24 hours (132% daily increase) by September 9, 2026, with nearly 7,000 total attempts between September 2-9. Primary attack sources include Germany, Hong Kong, Indonesia, UAE, and India. Previdian's honeypots recorded exploitation attempts from French and US IPs since July 2026.

## Vulnerable components

The flaw specifically impacts workflow API endpoints accepting inline task definitions. Systems using default GraalVM evaluator configurations with allowAllAccess(true) are most at risk. Any Conductor instance below version 3.30.2 that exposes workflow APIs to external networks should be considered compromised until patched.

## Current mitigation strategies

Orkes released version 3.30.2 to address the vulnerability. For organizations unable to patch immediately, security teams should restrict external API access, implement network controls around Conductor instances, and monitor for suspicious workflow submissions. Special attention should be given to unexpected command execution logs.

## Attack detection challenges

The exploitation leaves minimal traces since it uses legitimate API pathways. Defenders must scrutinize workflow submissions containing JavaScript/Python expressions, especially those attempting Java reflection calls. Empirical Security confirmed active exploitation continuing through August 2026, suggesting prolonged attacker interest.

## Broader implications

This vulnerability highlights risks in workflow automation platforms that combine multiple scripting engines. The GraalVM integration specifically creates attack surfaces when configured permissively. Similar platforms using polyglot execution environments should audit their sandboxing implementations and host access controls.

## Prioritization urgency

With active exploitation delivering full system compromise, this vulnerability warrants immediate attention. The 9.8 CVSS score reflects both low attack complexity and high impact. Organizations should treat unpatched Conductor instances as critically exposed, particularly those handling sensitive data or business-critical workflows.

## Sources covering this story

- https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html — 

---

_Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._