Orkes Conductor CVE-2026-58138: Exploitation Activity Observed Against Unauthenticated Workflow RCE

1. Basic Information

• Original Title: September 2026 CVE of the Month: The 9.8 Nobody Knows They Are Running (CVE-2026-58138)
• Source: Empirical Security
• Publication Date: September 1, 2026
• Updated Date: None
• Severity: Critical
• Basis of Severity: Sending malicious workflow definitions to the Conductor OSS Workflow API, which lacks authentication by default, allows OS commands to execute with the privileges of the Conductor process, which is often root in the default container image. Empirical Security observed exploitation activity in its telemetry, while SecurityWeek reported that Fortinet blocked about 1,300 attempts. Successful code execution in those attempts has not been publicly confirmed.
• Reference: September 2026 CVE of the Month: The 9.8 Nobody Knows They Are Running (CVE-2026-58138)
• Related Source: SecurityWeek Coverage
• Related Entities: CVE-2026-58138, Orkes Conductor, conductor-oss, GraalVM, INLINE, LAMBDA, DO_WHILE, SWITCH

2. Executive Summary

Attackers can register and start workflows containing malicious JavaScript or Python expressions through an unpatched, publicly exposed Conductor Workflow API, enabling OS command execution through GraalVM's HostAccess.ALL.

3. Attack Flow

OS Command Execution via Pre-Authentication API

1. An attacker discovers an externally reachable Conductor Workflow API.
2. The attacker submits a workflow definition containing an INLINE, LAMBDA, DO_WHILE, or SWITCH task with a malicious JavaScript or Python expression.
3. The definition is registered without authentication, and the workflow is started.
4. Java reflection or subprocesses are invoked from the GraalVM context configured with HostAccess.ALL or allowAllAccess(true).
5. OS commands are executed with the privileges of the Conductor process, potentially enabling access to connected systems and sensitive data.

4. Attacker Position and Execution Environment

• An unauthenticated remote attacker with network reachability to the Workflow API.
• Commands are executed within the Conductor host or container under the privileges of the Conductor process, which may be root in default containers.

5. Visibility for Victims and Administrators

• Victims: No user interaction is required, and there may be no visible indicators on the UI.
• Administrators: Unauthorized workflow definitions, INLINE or similar task types containing suspicious expressions, external POST requests to the Workflow API, and unexpected child processes or outbound traffic from Conductor serve as indicators.

6. Conditions for Success and Failure

Conditions for Success

• Using a vulnerable version of Conductor OSS from 3.21.21 up to, but not including, 3.30.2.
• The Workflow API is reachable and not protected by authentication or network controls.

Conditions for Failure

• Updating to version 3.30.2 or later and restricting the Workflow API to internal networks.
• Denying external workflow registration and execution through authentication, authorization, and network controls.

7. Impact upon Success

• Arbitrary OS commands are executed with the privileges of the Conductor process.
• Compromise may spread to data, credentials, microservices, and AI agents connected by the workflow.

8. Observable Logs

• Email: No email vector involvement has been confirmed.
• Proxy / SWG / DNS: Check for external POST requests to the Workflow API and subsequent outbound name resolution and retrieval.
• Endpoint / EDR: Check for child processes such as shells, Python, or curl spawned by the Java or Conductor process.
• Identity / IdP: The attack itself occurs pre-authentication. Verify service credentials utilized after a compromise.
• SaaS / Cloud: Check audit logs for workflow definitions and execution history, secret references, and connected APIs.
• Network: Check for suspicious POST requests to public APIs and unknown destination traffic originating from Conductor.

9. Attack Success Assessment

Confirmed in Public Information

• Attack Attempts Observed (Success Unconfirmed): Empirical Security observed exploitation activity in telemetry on August 21, 2026, and SecurityWeek reported that Fortinet blocked about 1,300 attempts between September 8 and 9. Successful code execution for individual attempts has not been confirmed.

Internal Assessment Criteria

• Confirm Initial Execution: Correlate malicious workflow initiation with Conductor child processes or command output.
• Confirm Subsequent Compromise: Corroborate secret access, connection modifications, C2 activity, and additional payloads with secondary evidence.

10. Investigation Playbook

• Trigger: Start with unpatched, publicly exposed Conductor instances, unknown INLINE expressions, and suspicious Workflow API POST requests.
• Initial Verification: Check version, exposure scope, authentication configuration, definition creator, and execution timestamp.
• Endpoint: Preserve Java process trees, containers, file modifications, and shell history.
• Authentication and Cloud: Enumerate secrets and service accounts accessible to Conductor and revoke them as needed.
• Subsequent Activity: Track audit logs and data access for destinations connected by the workflow.
• Containment: Block APIs, update to version 3.30.2 or later, isolate compromised instances, and rotate credentials.
• Classification: Distinguish between scanning, definition registration, execution initiation, OS command execution, and destination compromise.

11. Defense and Detection Ideas

• Single Event: Detect definitions in INLINE or similar fields containing Java reflection, Runtime, ProcessBuilder, or subprocess calls.
• Time-Series Correlation: Correlate unauthenticated API POST requests, workflow initiation, Java child processes, and outbound network traffic.
• Hunting: Inventory all Conductor OSS versions, exposure scopes, root execution status, and unknown workflows.
• Log Gaps: Identifying the definition creator is difficult without API gateways or audit logs.
• Prioritized Mitigations: Prioritize updates, making instances private, implementing authentication and authorization, avoiding root execution, and minimizing secrets.

12. Facts, Inference, and Hypothesis

Facts

• CVE-2026-58138 affects Conductor versions 3.21.21 through 3.30.1 (>= 3.21.21 and < 3.30.2) and has a CVSS v3.1 base score of 9.8.
• The issue stems from broad host access within the GraalVM context used for evaluating user expressions.
• Empirical Security observed active exploitation in the wild, and SecurityWeek reported approximately 1,300 blocked attempts by Fortinet.

Inference

• The more service credentials Conductor holds, the wider the potential for lateral movement from host RCE; therefore, privilege reduction is required alongside patching.

Hypothesis

No additional hypotheses. Unverified items are documented in "Unknowns and Additional Investigation."

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (Confidence: high): Exploits public Workflow APIs.
• T1059 Command and Scripting Interpreter (Confidence: high): Executes OS commands from JavaScript or Python expressions.

14. Unknowns and Additional Investigation

• The number of successfully exploited environments, executed commands, and threat actors involved.
• The number of unique attack sources and targets among the approximately 1,300 attempts blocked by Fortinet.
• The specific impact scope on Orkes Cloud editions and various derivative distributions.

15. Impact on SOCs and Organizations

Because Conductor is rarely recognized as a standard asset, yet holds high privileges at the center of microservices and AI agents, organizations must discover instances including SBOMs, containers, and developer self-managed environments while simultaneously reviewing exposure scope and secret privileges.

16. Summary by Role

• SOC: Correlate Workflow APIs, definition contents, Java child processes, and destination audit logs.
• Administrators: Update to version 3.30.2 or later, make APIs private and authenticated, and operate with non-root privileges and least privilege.
• Users: No general user action required. Developers should avoid executing suspicious workflows.