# Critical Pre-Auth RCE in Orkes Conductor Workflow Platform (CVE-2026-58138) Exploited in the Wild

> Orkes Conductor / Conductor OSS 3.21.21 through 3.30.1 evaluates user-supplied INLINE, LAMBDA, DO_WHILE, and SWITCH workflow task expressions inside a GraalVM polyglot context built with HostAccess.ALL, and the community API requires no authentication by default. A single unauthenticated HTTP request that registers and runs a hostile workflow definition reaches java.lang.Runtime via Java reflection and executes arbitrary OS commands, typically as root. Fortinet recorded ~6,696 blocked exploitation attempts between September 2-9, 2026 (1,290 in the final 24 hours, a 132% day-over-day increase), following a public Exploit-DB PoC (EDB-52633, published 2026-08-10) and confirmed in-the-wild exploitation observed by Empirical Security starting 2026-08-21.

- **Published:** 2026-09-19T00:00:00Z
- **Last reviewed:** 2026-09-19T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2574
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-orkes-conductor-rce-tl-2026-2574.webp?v=db3bba80 (Threadlinqs threat intel: CVE-2026-58138 Orkes Conductor RCE: Detection & IOCs (TL-2026-2574) — Critical severity, 8 IOCs, 9 detection rules.)
- **ID:** TL-2026-2574
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 8
- **CVEs:** CVE-2026-58138, CVE-2025-26074

## Description

CVE-2026-58138 is a critical, unauthenticated remote code execution vulnerability in Orkes Conductor / Conductor OSS, the Java-based workflow orchestration engine deployed by Orkes and used (per Empirical Security's telemetry) inside more than 3,000 enterprises. The root cause is architectural: Conductor's ScriptEvaluator builds its GraalVM polyglot JavaScript/Python execution context with allowHostAccess(HostAccess.ALL) (equivalent to allowAllAccess(true)), which grants scripts running inside INLINE, LAMBDA, DO_WHILE, and SWITCH task expressions full, unsandboxed interop with the JVM host — including Java reflection and process execution. Because the OSS/community Conductor API enforces no authentication by default, any network-reachable attacker can submit a workflow definition carrying a malicious expression and trigger it without credentials.

The attack chain documented across the PoC and vendor advisories runs in three unauthenticated HTTP calls: (1) POST /api/metadata/workflow registers a workflow definition whose INLINE task sets evaluatorType to "javascript" (or "python") with an attacker-controlled expression; (2) POST /api/workflow/{workflowName} starts execution of that workflow, invoking the evaluator; (3) GET /api/workflow/{workflowId}?includeTasks=true retrieves the task's output, which carries the command results back to the attacker. Inside the expression, the payload walks a Java reflection chain from the bound `$` parameter object (getClass().getClass() ... Class.forName("java.lang.Runtime")) to reach Runtime.getRuntime().exec(), constructs a shell invocation (['sh','-c','<command>']), and reads stdout via a BufferedReader. Because Conductor's default container image frequently runs the process as root, a successful exploit yields root-level command execution and, per Empirical Security, "full control of the orchestration layer" and every downstream system the orchestrated workflows can reach.

This is not Conductor's first unsandboxed-scripting RCE: CVE-2025-26074 (disclosed 2025-06-30, fixed in 3.21.13) was functionally the same bug class using the older Nashorn JavaScript engine without restrictions. CVE-2026-58138 shows the same architectural flaw reappeared after Conductor migrated its evaluator to GraalVM — versions 3.30.0 and 3.30.1 shipped a partial reflection blocklist that vendor advisory VulnCheck notes was incomplete; the full fix (allowHostClassLoading(false) plus additional GraalJS engine hardening) shipped only in 3.30.2 (June 2026, patch commits 87a7d96 and c691e35 per VulnCheck, credited to researcher seqradev).

Exploitation escalated rapidly after a public Python PoC (Exploit-DB EDB-52633, credited to Mohammed Idrees Banyamer, published 2026-08-10) lowered the bar to a copy-paste attack; the default PoC command is `id; hostname`, used purely to confirm code execution and privilege level. Empirical Security's own sensors first observed in-the-wild exploitation on 2026-08-21 and recorded recurring activity across subsequent observation windows. FortiGuard Labs' Threat Signal Report (2026-09-09) and subsequent Outbreak Alert (2026-09-15) documented a sharp escalation: ~6,696 blocked attempts over September 2-9 (a 17% week-over-week increase) and 1,290 blocked attempts in the final 24 hours of that window alone (a 132% day-over-day jump), with attack traffic observed originating from Germany, Hong Kong, Indonesia, the UAE, and India. No specific attacker-controlled IP addresses, domains, or post-exploitation payload samples (webshells, cryptominers, C2 implants) have been publicly documented in any source reviewed; multiple sources explicitly note that successful code execution for individual observed attempts has not been confirmed, and detection so far is behavioral/signature-based rather than IOC-based. The vulnerability is not yet listed in the CISA KEV catalog as of this writing, but is tracked in VulnCheck's KEV feed, and at least 9 public PoC repositories exist on GitHub (3 reported as independently weaponized) alongside a verified Nuclei detection template — indicating broad automated-scanning tooling is already in circulation.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1588.006 Vulnerabilities
- T1190 Exploit Public-Facing Application
- T1059 Command and Scripting Interpreter
- T1059.006 Python
- T1059.007 JavaScript
- T1211 Exploitation for Stealth
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Orkes Conductor Unauthenticated Workflow Registration with Malicious Script Evaluator (CVE-2026-58138) — SPL** (`TL-2026-2574-SPL-001`)

Detects the initial-access/exploitation stage of CVE-2026-58138: an unauthenticated POST to the Conductor community API's /api/metadata/workflow or /api/workflow/{name} endpoints registering or executing an INLINE, LAMBDA, DO_WHILE, or SWITCH task whose evaluatorType is javascript or python, optionally carrying the getClass().getClass()...Class.forName("java.lang.Runtime") reflection chain used to escape the GraalVM sandbox. This is the exact three-call pattern documented in Exploit-DB EDB-52633 and observed at scale by FortiGuard (~6,696 blocked attempts, Sep 2-9 2026).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059, T1059.006, T1059.007, T1595.002, T1588.006
- **Data sources:** web_proxy_access_logs, load_balancer_access_logs, conductor_application_audit_logs, waf_logs
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web (sourcetype=access_combined OR sourcetype=nginx OR sourcetype="aws:elb:accesslogs" OR sourcetype="f5:bigip:hsl:accesslog")
  uri_path IN ("/api/metadata/workflow", "/api/workflow/*")
  method=POST
| eval malicious_evaluator=if(match(_raw, "(?i)\"evaluatorType\"\s*:\s*\"(javascript|python)\""), 1, 0)
| eval malicious_task_type=if(match(_raw, "(?i)\"type\"\s*:\s*\"(INLINE|LAMBDA|DO_WHILE|SWITCH)\""), 1, 0)
| eval reflection_chain=if(match(_raw, "(?i)getClass\(\)\.getClass\(\)|Class\.forName\(.{0,3}java\.lang\.Runtime"), 1, 0)
| eval unauthenticated=if(isnull(Authorization) OR len(Authorization)=0, 1, 0)
| where malicious_evaluator=1 AND malicious_task_type=1
| bin _time span=5m
| stats count as request_count values(uri_path) as endpoints_hit values(status) as http_status max(reflection_chain) as reflection_chain_seen max(unauthenticated) as unauthenticated_request by _time, src_ip, dest_ip, dest_port
| where request_count>=1 AND (dest_port=8080 OR dest_port=443 OR dest_port=80)
| sort - request_count
```

### Microsoft KQL

```kql
ConductorAPI_CL
| where TimeGenerated > ago(24h)
| where (HttpMethod_s == "POST") and (RequestPath_s == "/api/metadata/workflow" or RequestPath_s startswith "/api/workflow/")
| where RequestBody_s has "evaluatorType" and RequestBody_s has_any ("javascript", "python")
| where RequestBody_s has_any ("INLINE", "LAMBDA", "DO_WHILE", "SWITCH")
| extend ReflectionChain = RequestBody_s has "getClass().getClass()" or RequestBody_s has "Class.forName(\"java.lang.Runtime\")"
| extend Unauthenticated = isempty(AuthorizationHeader_s)
| summarize RequestCount = count(), Endpoints = make_set(RequestPath_s), ReflectionSeen = max(ReflectionChain) by ClientIP_s, DestinationPort_d, bin(TimeGenerated, 5m)
| where RequestCount >= 1
| order by RequestCount desc
```

### Sigma

```yaml
title: Orkes Conductor Unauthenticated Workflow Registration with Malicious Script Evaluator (CVE-2026-58138)
id: 7e3a1c2e-4f6b-4a8e-9c3d-1a2b3c4d5e6f
status: experimental
description: Detects an unauthenticated HTTP POST to the Orkes Conductor workflow metadata or execution API registering/running an INLINE, LAMBDA, DO_WHILE, or SWITCH task, consistent with exploitation of CVE-2026-58138 (unsandboxed GraalVM ScriptEvaluator RCE). Full-body evaluatorType/task-type confirmation requires WAF or app-log body capture (see the companion SPL/KQL rules).
references:
    - https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html
    - https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators
    - https://www.exploit-db.com/exploits/52633
author: Threadlinqs Team
date: 2026-09-19
tags:
    - attack.reconnaissance
    - attack.t1595.002
    - attack.resource-development
    - attack.t1588.006
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059
    - attack.t1059.006
    - attack.t1059.007
    - cve.2026.58138
logsource:
    category: webserver
    product: web
detection:
    selection_endpoint:
        cs-method: POST
        cs-uri-stem|contains:
            - '/api/metadata/workflow'
            - '/api/workflow/'
    filter_authenticated:
        cs-Authorization|exists: true
    condition: selection_endpoint and not filter_authenticated
falsepositives:
    - Legitimate Conductor administrators registering INLINE/LAMBDA workflow definitions via an authenticated internal CI/CD pipeline that happens to omit the Authorization header field from proxy logging
    - Authorized vulnerability scanning or Nuclei-based penetration testing deliberately probing the endpoint
level: critical
```

**Known false positives:**

- Legitimate authenticated administrators or CI/CD pipelines registering INLINE/LAMBDA/DO_WHILE/SWITCH workflow definitions as part of normal Conductor operations
- Authorized penetration testers or Nuclei-based scanning explicitly permitted against the environment

**Tuning notes:** Restrict to Conductor's known listening ports (default TCP/8080) and internet-facing zones to cut noise from internal automation; enable WAF/reverse-proxy full-request-body logging so evaluatorType/task-type JSON fields are queryable (required for the KQL/SPL body-match logic — the Sigma variant is body-blind and relies on unauthenticated-POST-to-endpoint alone, so pair it with the SPL/KQL rules for high-confidence triage); allowlist known internal Conductor UI/admin source IPs that legitimately call these endpoints with valid session tokens.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Orkes Conductor Unauthenticated Workflow Registration with Malicious Script Evaluator (CVE-2026-58138) — KQL (locked: unlock with TL Creds)
- Shell Spawned from Java Process — GraalVM Sandbox-Escape Post-Exploitation (CVE-2026-58138) — KQL (locked: unlock with TL Creds)
- Post-RCE Result-Retrieval Polling and Outbound Egress from Conductor JVM/Shell (CVE-2026-58138) — KQL (locked: unlock with TL Creds)
- Orkes Conductor Unauthenticated Workflow Registration with Malicious Script Evaluator (CVE-2026-58138) — Sigma (locked: unlock with TL Creds)
- Shell Spawned from Java Process — GraalVM Sandbox-Escape Post-Exploitation (CVE-2026-58138) — Sigma (locked: unlock with TL Creds)
- Post-RCE Result-Retrieval Polling and Outbound Egress from Conductor JVM/Shell (CVE-2026-58138) — Sigma (locked: unlock with TL Creds)
- Shell Spawned from Java Process — GraalVM Sandbox-Escape Post-Exploitation (CVE-2026-58138) — SPL (locked: unlock with TL Creds)
- Post-RCE Result-Retrieval Polling and Outbound Egress from Conductor JVM/Shell (CVE-2026-58138) — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild](https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html)
- [Orkes Conductor Evaluator Remote Code Execution | Outbreak Alert](https://fortiguard.fortinet.com/outbreak-alert/orkes-conductor-rce)
- [Orkes Conductor Evaluator Remote Code Execution | Threat Signal Report](https://www.fortiguard.com/threat-signal-report/6527/orkes-conductor-evaluator-remote-code-execution)
- [Critical Orkes Conductor Vulnerability Exploited in Attacks](https://www.securityweek.com/critical-orkes-conductor-vulnerability-exploited-in-attacks/)
- [Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators](https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators)
- [September 2026 CVE of the Month: The 9.8 Nobody Knows They Are Running (CVE-2026-58138)](https://research.empiricalsecurity.com/research/september-2026-cve-of-the-month)
- [OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution](https://www.exploit-db.com/exploits/52633)
- [GitHub - Ch4120N/CVE-2026-58138: Lab + PoC, verified e2e (root)](https://github.com/Ch4120N/CVE-2026-58138)
- [GitHub - BiiTts/CVE-2026-58138-Conductor-Unauth-RCE: Lab + PoC, verified e2e (root)](https://github.com/BiiTts/CVE-2026-58138-Conductor-Unauth-RCE)
- [OSV.dev - CVE-2026-58138 (conductor-oss/conductor)](https://osv.dev/vulnerability/CVE-2026-58138)
- [CVE-2026-58138: Orkes Conductor 3.21.21 < 3.30.2](https://socradar.io/free-tools/cve-radar/CVE-2026-58138)
- [Orkes Conductor CVE-2026-58138: Exploitation Activity Observed Against Unauthenticated Workflow RCE](https://dev.to/anoymask/orkes-conductor-cve-2026-58138-exploitation-activity-observed-against-unauthenticated-workflow-rce-2gkk)
- [conductor-oss/conductor v3.30.2 release notes](https://github.com/conductor-oss/conductor/releases/tag/v3.30.2)
- [CVE-2025-26074: Remote Code Execution in Conductor OSS via inline JavaScript Injection](https://medium.com/@mrcnry/cve-2025-26074-remote-code-execution-in-conductor-oss-via-inline-javascript-injection-5ce3cb651cfb)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2574