Skip to navigation

Threat reportVulnerabilityTL-2026-2574

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform (CVE-2026-58138) Exploited in the Wild

criticalACTIVE

Orkes Conductor / Conductor OSS 3.21.21 through 3.30.1 evaluates user-supplied INLINE, LAMBDA, DO_WHILE, and SWITCH workflow task expressions inside a GraalVM polyglot context built with HostAccess.ALL, and the community API requires no authentication by default. A single unauthenticated HTTP request that registers and runs a hostile workflow definition reaches java.lang.Runtime via Java reflection and executes arbitrary OS commands, typically as root.

Key facts

IdentifiersTL-2026-2574, CVE-2026-58138, CVE-2025-26074
SeverityCRITICAL
CVSS9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
EPSSCVE-2026-58138: 14.6% (96.5th percentile); CVE-2025-26074: 0.7% (52.2th percentile)
Affected productsOrkes Orkes Conductor / Conductor OSS (conductor-oss/conductor, Maven artifact org.conductoross:conductor-core); Orkes Conductor OSS (predecessor vulnerability, Nashorn-based evaluator)
Weaknesses (CWE)CWE-94
ToolsExploit-DB EDB-52633, GitHub PoC repository Ch4120N/CVE-2026-58138, Nuclei template for CVE-2026-58138
MITRE ATT&CK techniquesT1033 System Owner/User Discovery, T1059 Command and Scripting Interpreter, T1059.006 Python, T1059.007 JavaScript, T1071.001 Web Protocols, T1082 System Information Discovery, T1190 Exploit Public-Facing Application, T1211 Exploitation for Stealth, T1588.006 Vulnerabilities, T1595.002 Vulnerability Scanning
MotivationUNKNOWN
Target sectorstechnology, telecoms, health
Target regionsGlobal
Detection rules9 (1 shown free)
Sources14 cited sources

Detection coverage

As of 2026-09-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2574 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Orkes Conductor Unauthenticated Workflow Registration with Malicious Script Evaluator (CVE-2026-58138) — SPL

Detects the initial-access/exploitation stage of CVE-2026-58138: an unauthenticated POST to the Conductor community API's /api/metadata/workflow or /api/workflow/{name} endpoints registering or executing an INLINE, LAMBDA, DO_WHILE, or SWITCH task whose evaluatorType is javascript or python, optionally carrying the getClass().getClass()...Class.forName("java.lang.Runtime") reflection chain used to escape the GraalVM sandbox. This is the exact three-call pattern documented in Exploit-DB EDB-52633 and observed at scale by FortiGuard (~6,696 blocked attempts, Sep 2-9 2026).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1059, T1059.006, T1059.007, T1595.002, T1588.006
  • Data sources: web_proxy_access_logs, load_balancer_access_logs, conductor_application_audit_logs, waf_logs
  • Severity: critical
  • Confidence: high

Splunk SPL

index=web (sourcetype=access_combined OR sourcetype=nginx OR sourcetype="aws:elb:accesslogs" OR sourcetype="f5:bigip:hsl:accesslog")
  uri_path IN ("/api/metadata/workflow", "/api/workflow/*")
  method=POST
| eval malicious_evaluator=if(match(_raw, "(?i)\"evaluatorType\"\s*:\s*\"(javascript|python)\""), 1, 0)
| eval malicious_task_type=if(match(_raw, "(?i)\"type\"\s*:\s*\"(INLINE|LAMBDA|DO_WHILE|SWITCH)\""), 1, 0)
| eval reflection_chain=if(match(_raw, "(?i)getClass\(\)\.getClass\(\)|Class\.forName\(.{0,3}java\.lang\.Runtime"), 1, 0)
| eval unauthenticated=if(isnull(Authorization) OR len(Authorization)=0, 1, 0)
| where malicious_evaluator=1 AND malicious_task_type=1
| bin _time span=5m
| stats count as request_count values(uri_path) as endpoints_hit values(status) as http_status max(reflection_chain) as reflection_chain_seen max(unauthenticated) as unauthenticated_request by _time, src_ip, dest_ip, dest_port
| where request_count>=1 AND (dest_port=8080 OR dest_port=443 OR dest_port=80)
| sort - request_count

Microsoft KQL

ConductorAPI_CL
| where TimeGenerated > ago(24h)
| where (HttpMethod_s == "POST") and (RequestPath_s == "/api/metadata/workflow" or RequestPath_s startswith "/api/workflow/")
| where RequestBody_s has "evaluatorType" and RequestBody_s has_any ("javascript", "python")
| where RequestBody_s has_any ("INLINE", "LAMBDA", "DO_WHILE", "SWITCH")
| extend ReflectionChain = RequestBody_s has "getClass().getClass()" or RequestBody_s has "Class.forName(\"java.lang.Runtime\")"
| extend Unauthenticated = isempty(AuthorizationHeader_s)
| summarize RequestCount = count(), Endpoints = make_set(RequestPath_s), ReflectionSeen = max(ReflectionChain) by ClientIP_s, DestinationPort_d, bin(TimeGenerated, 5m)
| where RequestCount >= 1
| order by RequestCount desc

Sigma

title: Orkes Conductor Unauthenticated Workflow Registration with Malicious Script Evaluator (CVE-2026-58138)
id: 7e3a1c2e-4f6b-4a8e-9c3d-1a2b3c4d5e6f
status: experimental
description: Detects an unauthenticated HTTP POST to the Orkes Conductor workflow metadata or execution API registering/running an INLINE, LAMBDA, DO_WHILE, or SWITCH task, consistent with exploitation of CVE-2026-58138 (unsandboxed GraalVM ScriptEvaluator RCE). Full-body evaluatorType/task-type confirmation requires WAF or app-log body capture (see the companion SPL/KQL rules).
references:
    - https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html
    - https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators
    - https://www.exploit-db.com/exploits/52633
author: Threadlinqs Team
date: 2026-09-19
tags:
    - attack.reconnaissance
    - attack.t1595.002
    - attack.resource-development
    - attack.t1588.006
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - attack.t1059.006
    - attack.t1059.007
    - cve.2026.58138
logsource:
    category: webserver
    product: web
detection:
    selection_endpoint:
        cs-method: POST
        cs-uri-stem|contains:
            - '/api/metadata/workflow'
            - '/api/workflow/'
    filter_authenticated:
        cs-Authorization|exists: true
    condition: selection_endpoint and not filter_authenticated
falsepositives:
    - Legitimate Conductor administrators registering INLINE/LAMBDA workflow definitions via an authenticated internal CI/CD pipeline that happens to omit the Authorization header field from proxy logging
    - Authorized vulnerability scanning or Nuclei-based penetration testing deliberately probing the endpoint
level: critical

Known false positives:

  • Legitimate authenticated administrators or CI/CD pipelines registering INLINE/LAMBDA/DO_WHILE/SWITCH workflow definitions as part of normal Conductor operations
  • Authorized penetration testers or Nuclei-based scanning explicitly permitted against the environment

Tuning notes: Restrict to Conductor's known listening ports (default TCP/8080) and internet-facing zones to cut noise from internal automation; enable WAF/reverse-proxy full-request-body logging so evaluatorType/task-type JSON fields are queryable (required for the KQL/SPL body-match logic — the Sigma variant is body-blind and relies on unauthenticated-POST-to-endpoint alone, so pair it with the SPL/KQL rules for high-confidence triage); allowlist known internal Conductor UI/admin source IPs that legitimately call these endpoints with valid session tokens.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Orkes Conductor Unauthenticated Workflow Registration with Malicious Script Evaluator (CVE-2026-58138) — KQL · unlock with TL Creds
  • Shell Spawned from Java Process — GraalVM Sandbox-Escape Post-Exploitation (CVE-2026-58138) — KQL · unlock with TL Creds
  • Post-RCE Result-Retrieval Polling and Outbound Egress from Conductor JVM/Shell (CVE-2026-58138) — KQL · unlock with TL Creds
  • Orkes Conductor Unauthenticated Workflow Registration with Malicious Script Evaluator (CVE-2026-58138) — Sigma · unlock with TL Creds
  • Shell Spawned from Java Process — GraalVM Sandbox-Escape Post-Exploitation (CVE-2026-58138) — Sigma · unlock with TL Creds
  • Post-RCE Result-Retrieval Polling and Outbound Egress from Conductor JVM/Shell (CVE-2026-58138) — Sigma · unlock with TL Creds
  • Shell Spawned from Java Process — GraalVM Sandbox-Escape Post-Exploitation (CVE-2026-58138) — SPL · unlock with TL Creds
  • Post-RCE Result-Retrieval Polling and Outbound Egress from Conductor JVM/Shell (CVE-2026-58138) — SPL · unlock with TL Creds

Indicators of compromise

As of 2026-09-19, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-2574.

8 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

Fortinet recorded ~6,696 blocked exploitation attempts between September 2-9, 2026 (1,290 in the final 24 hours, a 132% day-over-day increase), following a public Exploit-DB PoC (EDB-52633, published 2026-08-10) and confirmed in-the-wild exploitation observed by Empirical Security starting 2026-08-21.

CVE-2026-58138 is a critical, unauthenticated remote code execution vulnerability in Orkes Conductor / Conductor OSS, the Java-based workflow orchestration engine deployed by Orkes and used (per Empirical Security's telemetry) inside more than 3,000 enterprises. The root cause is architectural: Conductor's ScriptEvaluator builds its GraalVM polyglot JavaScript/Python execution context with allowHostAccess(HostAccess.ALL) (equivalent to allowAllAccess(true)), which grants scripts running inside INLINE, LAMBDA, DO_WHILE, and SWITCH task expressions full, unsandboxed interop with the JVM host — including Java reflection and process execution. Because the OSS/community Conductor API enforces no authentication by default, any network-reachable attacker can submit a workflow definition carrying a malicious expression and trigger it without credentials.

The attack chain documented across the PoC and vendor advisories runs in three unauthenticated HTTP calls: (1) POST /api/metadata/workflow registers a workflow definition whose INLINE task sets evaluatorType to "javascript" (or "python") with an attacker-controlled expression; (2) POST /api/workflow/{workflowName} starts execution of that workflow, invoking the evaluator; (3) GET /api/workflow/{workflowId}?includeTasks=true retrieves the task's output, which carries the command results back to the attacker. Inside the expression, the payload walks a Java reflection chain from the bound `$` parameter object (getClass().getClass() ... Class.forName("java.lang.Runtime")) to reach Runtime.getRuntime().exec(), constructs a shell invocation (['sh','-c','<command>']), and reads stdout via a BufferedReader. Because Conductor's default container image frequently runs the process as root, a successful exploit yields root-level command execution and, per Empirical Security, "full control of the orchestration layer" and every downstream system the orchestrated workflows can reach.

This is not Conductor's first unsandboxed-scripting RCE: CVE-2025-26074 (disclosed 2025-06-30, fixed in 3.21.13) was functionally the same bug class using the older Nashorn JavaScript engine without restrictions. CVE-2026-58138 shows the same architectural flaw reappeared after Conductor migrated its evaluator to GraalVM — versions 3.30.0 and 3.30.1 shipped a partial reflection blocklist that vendor advisory VulnCheck notes was incomplete; the full fix (allowHostClassLoading(false) plus additional GraalJS engine hardening) shipped only in 3.30.2 (June 2026, patch commits 87a7d96 and c691e35 per VulnCheck, credited to researcher seqradev).

Exploitation escalated rapidly after a public Python PoC (Exploit-DB EDB-52633, credited to Mohammed Idrees Banyamer, published 2026-08-10) lowered the bar to a copy-paste attack; the default PoC command is `id; hostname`, used purely to confirm code execution and privilege level. Empirical Security's own sensors first observed in-the-wild exploitation on 2026-08-21 and recorded recurring activity across subsequent observation windows. FortiGuard Labs' Threat Signal Report (2026-09-09) and subsequent Outbreak Alert (2026-09-15) documented a sharp escalation: ~6,696 blocked attempts over September 2-9 (a 17% week-over-week increase) and 1,290 blocked attempts in the final 24 hours of that window alone (a 132% day-over-day jump), with attack traffic observed originating from Germany, Hong Kong, Indonesia, the UAE, and India. No specific attacker-controlled IP addresses, domains, or post-exploitation payload samples (webshells, cryptominers, C2 implants) have been publicly documented in any source reviewed; multiple sources explicitly note that successful code execution for individual observed attempts has not been confirmed, and detection so far is behavioral/signature-based rather than IOC-based. The vulnerability is not yet listed in the CISA KEV catalog as of this writing, but is tracked in VulnCheck's KEV feed, and at least 9 public PoC repositories exist on GitHub (3 reported as independently weaponized) alongside a verified Nuclei detection template — indicating broad automated-scanning tooling is already in circulation.

MITRE ATT&CK techniques by tactic:

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1059.006 Python; T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols

Initial Access

T1190 Exploit Public-Facing Application

Stealth

T1211 Exploitation for Stealth

Resource Development

T1588.006 Vulnerabilities

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation

Patches

  • Orkes Conductor / Conductor OSS 3.30.2 (fixes CVE-2026-58138)
  • Conductor OSS 3.21.13 (fixes predecessor CVE-2025-26074)

Immediate actions

  • Upgrade Orkes Conductor / Conductor OSS to version 3.30.2 or later, which sets allowHostClassLoading(false) and hardens the GraalJS script evaluator configuration
  • Restrict network access to the Conductor workflow API (POST /api/metadata/workflow, POST /api/workflow/*, GET /api/workflow/*) — do not expose the community/OSS API directly to the internet
  • Place any internet-reachable Conductor instance behind an authenticating reverse proxy or API gateway and a firewall until patched

Workarounds

  • If immediate upgrade is not possible, disable or block registration/execution of INLINE, LAMBDA, DO_WHILE, and SWITCH task types at the API gateway layer
  • Enforce authentication in front of the community/OSS Conductor API, which has no authentication enabled by default

Longer-term hardening

  • Run the Conductor process as a non-root, least-privilege user instead of the container image default, to cap the blast radius of any future evaluator-sandbox escape
  • Deploy host/EDR behavioral monitoring for unexpected child processes spawned by the Conductor JVM (e.g., sh, bash, or other interpreters launched from a Java parent)
  • Given the recurrence of unsandboxed-evaluator RCEs in this codebase (CVE-2025-26074 in the Nashorn engine, CVE-2026-58138 in the GraalVM engine), track Conductor security advisories and re-verify evaluator sandboxing on every future engine migration or task-type addition

Affected and fixed versions

  • Orkes — Orkes Conductor / Conductor OSS (conductor-oss/conductor, Maven artifact org.conductoross:conductor-core)
    Vulnerable versions: 3.21.21 through 3.30.1 (3.30.0-3.30.1 shipped only a partial reflection blocklist)
    Fixed in: 3.30.2 and later
  • Orkes — Conductor OSS (predecessor vulnerability, Nashorn-based evaluator)
    Vulnerable versions: prior to 3.21.13 (CVE-2025-26074)
    Fixed in: 3.21.13 and later

Timeline

  • Predecessor vulnerability CVE-2025-26074 disclosed: unauthenticated RCE in Conductor OSS via unrestricted Nashorn JavaScript engine access in INLINE tasks, fixed in 3.21.13.
  • CVE-2026-58138 published; Orkes Conductor 3.30.2 released fixing the GraalVM evaluator by disabling host class loading and hardening the GraalJS engine (patch commits 87a7d96 and c691e35, credited to researcher seqradev).
  • Public unauthenticated RCE exploit published on Exploit-DB as EDB-52633 by Mohammed Idrees Banyamer, providing a copy-paste Python weaponization of the vulnerability.
  • Empirical Security's sensor telemetry first observes in-the-wild exploitation activity against CVE-2026-58138, with recurring activity in subsequent observation windows.
  • Start of the 7-day window (through Sep 9) in which FortiGuard recorded roughly 6,696 blocked exploitation attempts, a 17% week-over-week increase.
  • FortiGuard Labs releases a Threat Signal Report documenting 1,290 blocked attempts in the preceding 24 hours (a 132% day-over-day increase) and attack traffic originating from Germany, Hong Kong, Indonesia, the UAE, and India.
  • FortiGuard Labs escalates coverage to a full Outbreak Alert given sustained mass exploitation and public PoC/Nuclei-template availability.
  • The Hacker News publishes coverage of active in-the-wild exploitation, summarizing Fortinet's attack telemetry and the underlying GraalVM sandbox-escape root cause.

Sources cited

Previous and next in vulnerability

Drafted by the Threadlinqs research pipeline from 14 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats