Security1 publisher2 min readPublished
Attackers run root commands on Orkes Conductor with a single unauthenticated POST
Orkes Conductor evaluates workflow expressions on a GraalVM context with the sandbox disabled, and Fortinet blocked about 1,300 exploitation attempts against CVE-2026-58138 over two days in September.
The Watch · Security desk
What happened
- CVE-2026-58138, rated CVSS 9.8, lets an unauthenticated attacker submit an inline workflow definition to the Orkes Conductor workflow API with JavaScript or Python that invokes arbitrary system commands.
- Orkes patched the flaw in June in Conductor 3.30.2.
- Empirical Security saw in-the-wild attacks on August 21, and Fortinet blocked roughly 1,300 exploitation attempts between September 8 and 9 before issuing an outbreak alert this week.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure Because the Conductor process commonly runs with root privileges, an internet-reachable instance hands over command execution on the host, so anyone who was exposed during the exploitation window is dealing with host-level compromise.
- decision Teams that upgraded after early August still have to establish whether their workflow API was reachable while the PoC was public, and decide whether to treat the host as breached.
- constraint A one-request exploit against an open API gives defenders almost no dwell time to detect. For instances that cannot be upgraded this week, network-edge blocking is the only control left.
- precedent For orchestration software that ships without authentication enabled, real exposure begins when PoC code is published.
The exploit is one HTTP request. "No login stands in the way, because the open-source server enforces no authentication by default and leaves its workflow API open. A single unauthenticated POST registers a workflow with a hostile INLINE task and starts it," Empirical Security wrote [5].
Empirical Security described where that code runs: "An INLINE task (and LAMBDA, DO_WHILE, and SWITCH tasks) evaluates a user-supplied JavaScript or Python expression, and Conductor builds that evaluator on a GraalVM context configured with HostAccess.ALL" [3]. That setting disables the sandbox, and the attacker-supplied code reflects into the Java runtime and executes OS commands as the Conductor process, which often runs with root privileges [4]. Four task types reach the same evaluator, so a request filter keyed only to INLINE leaves three paths open [4].
Conductor is the layer organisations use to orchestrate microservices, workflows and AI agents [2]. The vulnerable process sits in the middle of a service graph.
Orkes fixed the bug in June, in version 3.30.2 [6]. Those dates matter more than the 9.8 score [1]. Proof-of-concept code appeared in early August and exploitation followed shortly after [7]. Empirical Security identified in-the-wild attacks on August 21 [8], which is at least seven weeks after the patch was available even if the fix shipped on the last day of June [2]. Fortinet blocked roughly 1,300 exploitation attempts between September 8 and 9 [9], an average of about 650 a day across its sensors [1], and issued an outbreak alert on the ongoing exploitation this week [10]. SecurityWeek did not name a victim or attribute the activity to a specific group [3].
Patching to 3.30.2 or later is the first step; the advice that follows it is restricting external access to the workflow API endpoints, keeping deployments behind a firewall, and not exposing the services directly to the internet [11]. The rest of the guidance covers detection and intrusion review: monitor instances for suspicious workflow submissions and unauthorised command execution, and review systems that ran vulnerable versions for signs of intrusion [12]. SecurityWeek reported the flaw has been in attackers' sights for at least a month [14].
What to watch
- Whether Fortinet's daily block counts keep climbing after the outbreak alert or fall away.
- Whether any named victim or threat actor gets attached to the activity Empirical Security saw on August 21.
- Whether a later Orkes release enables authentication on the workflow API by default.