Orkes Conductor CVE-2026-58138: Pre-Auth RCE via Unsandboxed Workflow Scripts

The workflow engine that nobody in security inventories is getting sprayed. Orkes / Conductor-OSS has a CVSS 9.8 unauthenticated RCE where a hostile workflow definition runs OS commands as the Conductor process — often root in the default container — and Fortinet has been blocking thousands of exploitation attempts.

What happened

CVE-2026-58138 affects Orkes Conductor / conductor-oss roughly 3.21.21 through versions before 3.30.2. Attackers POST workflow metadata containing INLINE / LAMBDA / DO_WHILE / SWITCH tasks whose JavaScript or Python expressions run in GraalVM contexts built with HostAccess.ALL / allowAllAccess(true). That turns the “sandbox” off. Reflection reaches Runtime / ProcessBuilder, and commands execute with Conductor’s privileges.

The open-source server ships without authentication by default, so the workflow API is frequently an unauthenticated remote door. A fix landed in 3.30.2 (June 2026); public exploit code and Exploit-DB material followed. FortiGuard outbreak telemetry reported ~1,290 blocked attempts in 24 hours (early September) and multi-thousand weekly volumes, with Empirical Security also observing in-the-wild exploitation. SecurityWeek and Fortinet outbreak alerts in mid-September framed ongoing opportunistic scanning.

Why it matters

Conductor sits in the middle of microservice and AI-agent orchestration. Compromising it is rarely the end of the intrusion — it already holds credentials and reach into everything it orchestrates. Orkes publicly cites thousands of enterprise deployments; many more open-source installs never appear on vulnerability scanners (credentialed plugins for this CVE have been scarce). Severity was never the blind spot. Discovery was.

What to do first

• Find Conductor before you trust a clean scan: UI title “Conductor UI”, default API port 8080, Swagger at /swagger-ui, images conductoross/conductor, Helm charts, platform/ML team workflow stacks. Shodan/Censys: http.title:"Conductor UI".
• Upgrade to 3.30.2 or later. Do not stop at 3.30.0 / 3.30.1 (partial mitigations only).
• Until patched: take /api/metadata/workflow and /api/workflow off untrusted networks; put a reverse proxy or Spring Security filter in front; require authentication.
• Hunt existing workflow definitions for INLINE/LAMBDA/DO_WHILE/SWITCH with evaluatorType javascript/graaljs/python whose expressions reference getClass, forName, Runtime, ProcessBuilder, or array reflection.
• Watch Conductor JVMs for child shells (sh, bash, curl, wget) they should never spawn.
• Assume internet-exposed unpatched instances may already be owned — rotate secrets the orchestrator could reach.

Details

• CVE: CVE-2026-58138 (CVSS 3.1 9.8 / CVSS 4 ~9.3)
• CWE: CWE-94 (code generation / injection)
• Affected: Conductor ~3.21.21 to <3.30.2
• Fixed: 3.30.2+
• Auth: None required on default open-source builds
• KEV: Not listed as of research time — still treat as actively exploited
• PoC: Public / Exploit-DB; Nuclei template available

Hunt / verify

• Inventory every Conductor/Orkes endpoint (including “temporary” AI-agent sandboxes).
• Diff workflow definitions and audit logs around unauthenticated POSTs to workflow APIs.
• Confirm process user and whether containers run as root.
• Validate version string ≥ 3.30.2 on every node.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-58138
• https://research.empiricalsecurity.com/research/september-2026-cve-of-the-month
• https://www.fortiguard.com/threat-signal-report/6527/orkes-conductor-evaluator-remote-code-execution
• https://fortiguard.fortinet.com/outbreak-alert/orkes-conductor-rce
• https://www.securityweek.com/critical-orkes-conductor-vulnerability-exploited-in-attacks/
• https://github.com/conductor-oss/conductor/releases/tag/v3.30.2

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].