A critical vulnerability in Orkes Conductor, an open-source enterprise framework for orchestrating microservices and workflows, has been actively exploited by attackers. This vulnerability, identified as CVE-2026-58138, allows remote code execution through unauthenticated access to the workflow API endpoint. With a CVSS score of 9.8, this flaw can be triggered by inserting malicious JavaScript or Python code into inline workflow definitions, which are then executed with potentially dangerous system commands. This issue arises from the way Conductor evaluates scripts within a workflow. The vulnerability exploits the GraalVM context, configured with HostAccess.ALL, which disables the sandbox and allows attacker-supplied code to interact with the Java runtime, executing OS commands as the Conductor process. This process often runs with elevated privileges, increasing the risk of severe damage.

The vulnerability was patched in Orkes Conductor version 3.30.2 in June. However, proof-of-concept code was released in early August, and exploitation began soon after. Notably, on August 21, Empirical Security reported attacks in the wild. Fortinet also noted blocking around 1,300 exploitation attempts in early September and issued an outbreak alert this week, highlighting the ongoing threat.

Organizations are advised to upgrade to Conductor version 3.30.2 or later to mitigate the risk. It is also crucial to restrict external access to workflow API endpoints, ensure these deployments are behind a firewall, and avoid exposing services directly to the internet. Continuous monitoring for suspicious workflow submissions and unauthorized command execution, alongside reviewing systems running susceptible versions for intrusion signs, is recommended to enhance security.