Full Report
A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet. The vulnerability in question is CVE-2026-58138 (CVSS v3.1 score: 9.8/CVSS v4 score: 9.3), which relates to a case of unauthenticated remote code execution. "Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote
Analysis Summary
# Vulnerability: Critical Unauthenticated RCE in Orkes Conductor
## CVE Details
- **CVE ID:** CVE-2026-58138
- **CVSS Score:** 9.8 (V3.1) / 9.3 (V4)
- **Severity:** Critical
- **CWE:** Not explicitly stated (Relates to Improper Neutralization of Special Elements used in an OS Command / Improper Input Validation)
## Affected Systems
- **Products:** Orkes Conductor (and open-source Conductor OSS)
- **Versions:** Version 3.21.21 through versions prior to 3.30.2
- **Configurations:** Systems utilizing unsandboxed GraalVM evaluators configured with `HostAccess.ALL` or `allowAllAccess(true)`.
## Vulnerability Description
The flaw is an unauthenticated Remote Code Execution (RCE) vulnerability within the Orkes Conductor workflow API. The application fails to properly sanitize inline workflow definitions. Attackers can submit malicious JavaScript or Python expressions via the API. Because the underlying GraalVM script evaluators are configured with unrestricted host access, an attacker can use Java reflection or direct subprocess calls to escape the script sandbox and execute arbitrary operating system commands with the privileges of the Conductor process. The vulnerability is triggered through `INLINE`, `LAMBDA`, `DO_WHILE`, and `SWITCH` task types.
## Exploitation
- **Status:** Exploited in the wild. Active targeting observed by Fortinet, Previdian, and Empirical Security.
- **Complexity:** Low (Attacker can submit crafted definitions directly to the API).
- **Attack Vector:** Network (Remote, unauthenticated).
## Impact
- **Confidentiality:** Critical (Full access to data accessible by the process).
- **Integrity:** Critical (Ability to modify system files and application logic).
- **Availability:** Critical (Potential for full system takeover or service disruption).
## Remediation
### Patches
- Upgrade to **Orkes Conductor version 3.30.2** or later.
### Workarounds
- Restrict external access to Conductor workflow API endpoints.
- Place Conductor instances behind strict network access controls (e.g., VPN, IP allowlisting).
- Disable or restrict the use of unsandboxed script evaluators if not business-critical.
## Detection
- **Indicators of Compromise:**
- Unexpected workflow submissions containing `Java.type`, `java.lang.Runtime`, or subprocess calls in JavaScript/Python blocks.
- API requests to workflow endpoints from unrecognized external IP addresses.
- **Detection methods and tools:**
- Monitor application logs for suspicious `INLINE` or `LAMBDA` task definitions.
- Use EDR/SIEM tools to alert on unexpected child processes spawned by the Orkes Conductor service.
## References
- **NIST NVD:** hxxps[://]nvd[.]nist[.]gov/vuln/detail/cve-2026-58138
- **Vendor Release:** hxxps[://]github[.]com/conductor-oss/conductor/releases/tag/v3.30.2
- **Fortinet Outbreak Alert:** hxxps[://]www[.]fortiguard[.]com/outbreak-alert/orkes-conductor-rce
- **Fortinet Threat Signal:** hxxps[://]www[.]fortiguard[.]com/threat-signal-report/6527/orkes-conductor-evaluator-remote-code-execution