Critical Orkes Conductor Vulnerability Exploited in Attacks

A critical vulnerability has been exploited in Orkes Conductor, a framework for orchestrating microservices. Tracked as CVE-2026-58138, this flaw allows attackers to execute arbitrary commands without requiring any authentication. The vulnerability stems from how Conductor evaluates user-supplied JavaScript or Python expressions within inline workflow definitions submitted to the workflow API endpoint. Specifically, Conductor builds a JavaScript or Python evaluator using GraalVM with HostAccess.ALL, disabling the sandbox and allowing attacker-supplied code to execute OS commands as the Conductor process, often with root privileges. The vulnerability was patched in June, but exploitation began shortly after a PoC was released in early August. Fortinet blocked approximately 1,300 exploitation attempts between September 8 and 9, and has since issued an outbreak alert. To address this issue, organizations should update to Conductor 3.30.2 or later, restrict external access to Conductor’s workflow API endpoints, ensure Conductor deployments are behind a firewall, and monitor for suspicious workflow submissions and unauthorized command execution.