Critical Pre-Auth RCE in Orkes Conductor Workflow Platform (CVE-2026-58138) Exploited in the Wild

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform (TL-2026-2574) is a critical-severity software vulnerability scored CVSS 9.8, first published 2026-09-19. It has no confirmed attribution, affects Orkes Orkes Conductor / Conductor OSS (conductor-oss/conductor, Maven, references 1 CVE (CVE-2026-58138), maps to 10 MITRE ATT&CK techniques (T1033, T1059, T1059.006), and is covered by 9 detection rules and 8 indicators of compromise.

Key facts for TL-2026-2574

Threat ID
TL-2026-2574
Severity
CRITICAL
CVSS
9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-09-19
Last reviewed
2026-09-19
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, telecoms, health
Target regions
Global
Detection rules
9
Indicators of compromise
8

Malware and tooling in Critical Pre-Auth RCE in Orkes Conductor Workflow Platform

Malware and tooling: Exploit-DB EDB-52633, GitHub PoC repository Ch4120N/CVE-2026-58138, Nuclei template for CVE-2026-58138

Orkes Conductor / Conductor OSS 3.21.21 through 3.30.1 evaluates user-supplied INLINE, LAMBDA, DO_WHILE, and SWITCH workflow task expressions inside a GraalVM polyglot context built with HostAccess.ALL, and the community API requires no authentication by default. A single unauthenticated HTTP request that registers and runs a hostile workflow definition reaches java.lang.Runtime via Java reflection and executes arbitrary OS commands, typically as root. Fortinet recorded ~6,696 blocked exploitation attempts between September 2-9, 2026 (1,290 in the final 24 hours, a 132% day-over-day increase), following a public Exploit-DB PoC (EDB-52633, published 2026-08-10) and confirmed in-the-wild exploitation observed by Empirical Security starting 2026-08-21.

How Critical Pre-Auth RCE in Orkes Conductor Workflow Platform works

CVE-2026-58138 is a critical, unauthenticated remote code execution vulnerability in Orkes Conductor / Conductor OSS, the Java-based workflow orchestration engine deployed by Orkes and used (per Empirical Security's telemetry) inside more than 3,000 enterprises. The root cause is architectural: Conductor's ScriptEvaluator builds its GraalVM polyglot JavaScript/Python execution context with allowHostAccess(HostAccess.ALL) (equivalent to allowAllAccess(true)), which grants scripts running inside INLINE, LAMBDA, DO_WHILE, and SWITCH task expressions full, unsandboxed interop with the JVM host — including Java reflection and process execution. Because the OSS/community Conductor API enforces no authentication by default, any network-reachable attacker can submit a workflow definition carrying a malicious expression and trigger it without credentials.

The attack chain documented across the PoC and vendor advisories runs in three unauthenticated HTTP calls: (1) POST /api/metadata/workflow registers a workflow definition whose INLINE task sets evaluatorType to "javascript" (or "python") with an attacker-controlled expression; (2) POST /api/workflow/{workflowName} starts execution of that workflow, invoking the evaluator; (3) GET /api/workflow/{workflowId}?includeTasks=true retrieves the task's output, which carries the command results back to the attacker. Inside the expression, the payload walks a Java reflection chain from the bound `$` parameter object (getClass().getClass() ... Class.forName("java.lang.Runtime")) to reach Runtime.getRuntime().exec(), constructs a shell invocation (['sh','-c','<command>']), and reads stdout via a BufferedReader. Because Conductor's default container image frequently runs the process as root, a successful exploit yields root-level command execution and, per Empirical Security, "full control of the orchestration layer" and every downstream system the orchestrated workflows can reach.

This is not Conductor's first unsandboxed-scripting RCE: CVE-2025-26074 (disclosed 2025-06-30, fixed in 3.21.13) was functionally the same bug class using the older Nashorn JavaScript engine without restrictions. CVE-2026-58138 shows the same architectural flaw reappeared after Conductor migrated its evaluator to GraalVM — versions 3.30.0 and 3.30.1 shipped a partial reflection blocklist that vendor advisory VulnCheck notes was incomplete; the full fix (allowHostClassLoading(false) plus additional GraalJS engine hardening) shipped only in 3.30.2 (June 2026, patch commits 87a7d96 and c691e35 per VulnCheck, credited to researcher seqradev).

Exploitation escalated rapidly after a public Python PoC (Exploit-DB EDB-52633, credited to Mohammed Idrees Banyamer, published 2026-08-10) lowered the bar to a copy-paste attack; the default PoC command is `id; hostname`, used purely to confirm code execution and privilege level. Empirical Security's own sensors first observed in-the-wild exploitation on 2026-08-21 and recorded recurring activity across subsequent observation windows. FortiGuard Labs' Threat Signal Report (2026-09-09) and subsequent Outbreak Alert (2026-09-15) documented a sharp escalation: ~6,696 blocked attempts over September 2-9 (a 17% week-over-week increase) and 1,290 blocked attempts in the final 24 hours of that window alone (a 132% day-over-day jump), with attack traffic observed originating from Germany, Hong Kong, Indonesia, the UAE, and India. No specific attacker-controlled IP addresses, domains, or post-exploitation payload samples (webshells, cryptominers, C2 implants) have been publicly documented in any source reviewed; multiple sources explicitly note that successful code execution for individual observed attempts has not been confirmed, and detection so far is behavioral/signature-based rather than IOC-based. The vulnerability is not yet listed in the CISA KEV catalog as of this writing, but is tracked in VulnCheck's KEV feed, and at least 9 public PoC repositories exist on GitHub (3 reported as independently weaponized) alongside a verified Nuclei detection template — indicating broad automated-scanning tooling is already in circulation.

MITRE ATT&CK techniques used in TL-2026-2574

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1059.006 Python; T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols

Initial Access

T1190 Exploit Public-Facing Application

Stealth

T1211 Exploitation for Stealth

Resource Development

T1588.006 Vulnerabilities

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in Critical Pre-Auth RCE in Orkes Conductor Workflow Platform

  • Orkes — Orkes Conductor / Conductor OSS (conductor-oss/conductor, Maven artifact org.conductoross:conductor-core)
    Vulnerable versions: 3.21.21 through 3.30.1 (3.30.0-3.30.1 shipped only a partial reflection blocklist)
    Fixed in: 3.30.2 and later
  • Orkes — Conductor OSS (predecessor vulnerability, Nashorn-based evaluator)
    Vulnerable versions: prior to 3.21.13 (CVE-2025-26074)
    Fixed in: 3.21.13 and later

Remediation for Critical Pre-Auth RCE in Orkes Conductor Workflow Platform

Patches

  • Orkes Conductor / Conductor OSS 3.30.2 (fixes CVE-2026-58138)
  • Conductor OSS 3.21.13 (fixes predecessor CVE-2025-26074)

Immediate actions

  • Upgrade Orkes Conductor / Conductor OSS to version 3.30.2 or later, which sets allowHostClassLoading(false) and hardens the GraalJS script evaluator configuration
  • Restrict network access to the Conductor workflow API (POST /api/metadata/workflow, POST /api/workflow/*, GET /api/workflow/*) — do not expose the community/OSS API directly to the internet
  • Place any internet-reachable Conductor instance behind an authenticating reverse proxy or API gateway and a firewall until patched

Workarounds

  • If immediate upgrade is not possible, disable or block registration/execution of INLINE, LAMBDA, DO_WHILE, and SWITCH task types at the API gateway layer
  • Enforce authentication in front of the community/OSS Conductor API, which has no authentication enabled by default

Longer-term hardening

  • Run the Conductor process as a non-root, least-privilege user instead of the container image default, to cap the blast radius of any future evaluator-sandbox escape
  • Deploy host/EDR behavioral monitoring for unexpected child processes spawned by the Conductor JVM (e.g., sh, bash, or other interpreters launched from a Java parent)
  • Given the recurrence of unsandboxed-evaluator RCEs in this codebase (CVE-2025-26074 in the Nashorn engine, CVE-2026-58138 in the GraalVM engine), track Conductor security advisories and re-verify evaluator sandboxing on every future engine migration or task-type addition

CVEs associated with Critical Pre-Auth RCE in Orkes Conductor Workflow Platform

CVE-2026-58138

Weaknesses (CWE) in Critical Pre-Auth RCE in Orkes Conductor Workflow Platform

CWE-94

Timeline of Critical Pre-Auth RCE in Orkes Conductor Workflow Platform

  • Predecessor vulnerability CVE-2025-26074 disclosed: unauthenticated RCE in Conductor OSS via unrestricted Nashorn JavaScript engine access in INLINE tasks, fixed in 3.21.13.
  • CVE-2026-58138 published; Orkes Conductor 3.30.2 released fixing the GraalVM evaluator by disabling host class loading and hardening the GraalJS engine (patch commits 87a7d96 and c691e35, credited to researcher seqradev).
  • Public unauthenticated RCE exploit published on Exploit-DB as EDB-52633 by Mohammed Idrees Banyamer, providing a copy-paste Python weaponization of the vulnerability.
  • Empirical Security's sensor telemetry first observes in-the-wild exploitation activity against CVE-2026-58138, with recurring activity in subsequent observation windows.
  • Start of the 7-day window (through Sep 9) in which FortiGuard recorded roughly 6,696 blocked exploitation attempts, a 17% week-over-week increase.
  • FortiGuard Labs releases a Threat Signal Report documenting 1,290 blocked attempts in the preceding 24 hours (a 132% day-over-day increase) and attack traffic originating from Germany, Hong Kong, Indonesia, the UAE, and India.
  • FortiGuard Labs escalates coverage to a full Outbreak Alert given sustained mass exploitation and public PoC/Nuclei-template availability.
  • The Hacker News publishes coverage of active in-the-wild exploitation, summarizing Fortinet's attack telemetry and the underlying GraalVM sandbox-escape root cause.

Sources cited for Critical Pre-Auth RCE in Orkes Conductor Workflow Platform

More in vulnerability

Detection coverage for TL-2026-2574

As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2574 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats