Attackers run root commands on Orkes Conductor with a single unauthenticated POST
Orkes Conductor evaluates workflow expressions on a GraalVM context with the sandbox disabled, and Fortinet blocked about 1,300 exploitation attempts against CVE-2026-58138 over two days in September.
The Watch · Security desk
What happened
- CVE-2026-58138, rated CVSS 9.8, lets an unauthenticated attacker submit an inline workflow definition to the Orkes Conductor workflow API with JavaScript or Python that invokes arbitrary system commands.
- Orkes patched the flaw in June in Conductor 3.30.2.
- Empirical Security saw in-the-wild attacks on August 21, and Fortinet blocked roughly 1,300 exploitation attempts between September 8 and 9 before issuing an outbreak alert this week.
Why it matters
- Who's exposed exposure Because the Conductor process commonly runs with root privileges, an internet-reachable instance hands over command execution on the host, so anyone who was exposed during the exploitation window is dealing with host-level compromise.
- Who has to decide decision Teams that upgraded after early August still have to establish whether their workflow API was reachable while the PoC was public, and decide whether to treat the host as breached.
- What it limits constraint A one-request exploit against an open API gives defenders almost no dwell time to detect. For instances that cannot be upgraded this week, network-edge blocking is the only control left.
- What it sets up precedent For orchestration software that ships without authentication enabled, real exposure begins when PoC code is published.
Next story · Security · 10h ago
CISA adds Atlassian Data Center flaw CVE-2026-21589 to its exploited-vulnerabilities listConfirmed2 publishers
The exploit is one HTTP request. "No login stands in the way, because the open-source server enforces no authentication by default and leaves its workflow API open. A single unauthenticated POST registers a workflow with a hostile INLINE task and starts it," Empirical Security wrote [4].
Empirical Security described where that code runs: "An INLINE task (and LAMBDA, DO_WHILE, and SWITCH tasks) evaluates a user-supplied JavaScript or Python expression, and Conductor builds that evaluator on a GraalVM context configured with HostAccess.ALL" [1]. That setting disables the sandbox, and the attacker-supplied code reflects into the Java runtime and executes OS commands as the Conductor process, which often runs with root privileges [2]. Four task types reach the same evaluator, so a request filter keyed only to INLINE leaves three paths open [14].
Conductor is the layer organisations use to orchestrate microservices, workflows and AI agents [12]. The vulnerable process sits in the middle of a service graph.
Orkes fixed the bug in June, in version 3.30.2 [5]. Those dates matter more than the 9.8 score [3]. Proof-of-concept code appeared in early August and exploitation followed shortly after [15]. Empirical Security identified in-the-wild attacks on August 21 [6], which is at least seven weeks after the patch was available even if the fix shipped on the last day of June [17]. Fortinet blocked roughly 1,300 exploitation attempts between September 8 and 9 [7], an average of about 650 a day across its sensors [16], and issued an outbreak alert on the ongoing exploitation this week [8]. SecurityWeek did not name a victim or attribute the activity to a specific group [13].
Patching to 3.30.2 or later is the first step; the advice that follows it is restricting external access to the workflow API endpoints, keeping deployments behind a firewall, and not exposing the services directly to the internet [9]. The rest of the guidance covers detection and intrusion review: monitor instances for suspicious workflow submissions and unauthorised command execution, and review systems that ran vulnerable versions for signs of intrusion [10]. SecurityWeek reported the flaw has been in attackers' sights for at least a month [11].
What to watch
- Whether Fortinet's daily block counts keep climbing after the outbreak alert or fall away.
- Whether any named victim or threat actor gets attached to the activity Empirical Security saw on August 21.
- Whether a later Orkes release enables authentication on the workflow API by default.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence68
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
"An INLINE task (and LAMBDA, DO_WHILE, and SWITCH tasks) evaluates a user-supplied JavaScript or Python expression, and Conductor builds that evaluator on a GraalVM context configured with HostAccess.ALL"
- [2]
The HostAccess.ALL configuration disables the sandbox, and the attacker-supplied code reflects into the Java runtime and executes OS commands as the Conductor process, which often runs with root privileges.
- [3]
CVE-2026-58138 in Orkes Conductor carries a CVSS score of 9.8 and is a remote code execution issue exploitable without authentication via inline workflow definitions submitted to the workflow API endpoint; attackers can include malicious JavaScript or Python expressions in the definitions to invoke arbitrary system commands.
- [4]
"No login stands in the way, because the open-source server enforces no authentication by default and leaves its workflow API open. A single unauthenticated POST registers a workflow with a hostile INLINE task and starts it"
- [5]
CVE-2026-58138 was patched in June in Orkes Conductor version 3.30.2.
- [6]
Empirical Security identified in-the-wild attacks exploiting the flaw on August 21.
- [7]
Fortinet blocked roughly 1,300 exploitation attempts between September 8 and 9.
- [8]
Fortinet released an outbreak alert this week on the vulnerability's ongoing exploitation.
- [9]
In addition to updating to Conductor 3.30.2 or later, organizations should restrict external access to Conductor's workflow API endpoints and ensure deployments are behind a firewall and not directly exposed to the internet.
- [10]
Organizations should also monitor their instances for suspicious workflow submissions and unauthorized command execution, and review systems running vulnerable versions for signs of intrusion.
- [11]
The critical-severity Orkes Conductor vulnerability, exploitable without authentication, has been in attackers' crosshairs for at least a month.
- [12]
Conductor is an open source unified enterprise framework that allows organizations to orchestrate microservices, workflows, and AI agents.
- [13]
The SecurityWeek report does not name a victim organization and does not attribute the exploitation to a named threat actor.
- [14]
Four task types (INLINE, LAMBDA, DO_WHILE and SWITCH) reach the same GraalVM evaluator, so filtering only on INLINE task submissions leaves three other paths to the same code execution.
- [15]
Proof-of-concept code targeting CVE-2026-58138 was published in early August, and exploitation started shortly after.
- [16]
Fortinet's block count averages about 650 exploitation attempts a day over the September 8 to 9 period.
- [17]
At least seven weeks separated the availability of the 3.30.2 patch from the first in-the-wild attacks Empirical Security identified.
Sources
2 independent publishers whose own reporting we read for this story.
- securityweek.comCritical Orkes Conductor Vulnerability Exploited in Attacks
2 articles · September 20, 2026
- thehackernews.comCritical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
2 articles · September 19, 2026
Topics and entities
Topics
- Workflow Orchestration
- Embedded script sandboxing
- Actively Exploited Vulnerabilities and KEV Mandates
Entities
- Fortinet
- Empirical Security
- GraalVM
- Previdian
- National Vulnerability Database