A Critical Vulnerability in Orkes Conductor Exposes Organizations to Remote Code Execution Attacks
A critical vulnerability in the open-source unified enterprise framework Orkes Conductor has been exploited by attackers in recent weeks. The flaw, tracked as CVE-2026-58138 and rated 9.8 on the CVSS scale, allows unauthenticated attackers to execute arbitrary system commands, potentially leading to data breaches and system compromise.
The vulnerability affects how Conductor runs scripts inside a workflow, allowing attackers to inject malicious JavaScript or Python expressions in the definitions submitted to the workflow API endpoint. These expressions can then invoke arbitrary system commands, which are executed with the privileges of the Conductor process – often running as root. This means that an attacker can gain unfettered access to the affected system without needing any login credentials.
Conductor’s default configuration allows its workflow API endpoints to be open and unauthenticated, making it easy for attackers to exploit this vulnerability. The bug was patched in June with Orkes Conductor version 3.30.2, but proof-of-concept code targeting the flaw was published in early August, likely leading to widespread exploitation.
Empirical Security has identified several attacks exploiting CVE-2026-58138, including a recent outbreak alert released by Fortinet after detecting roughly 1,300 attempts between September 8 and 9. Organizations affected by this vulnerability should update their Conductor installations to version 3.30.2 or later and restrict external access to its workflow API endpoints.
In addition to patching and restricting API access, organizations should monitor their instances for suspicious workflow submissions and unauthorized command execution. They should also review systems running vulnerable versions for signs of intrusion and take steps to prevent future attacks.
The Orkes Conductor vulnerability is a stark reminder that even seemingly secure software can harbor critical flaws. It highlights the importance of regular security updates, strict access controls, and vigilant monitoring to prevent exploitation by attackers. By taking proactive measures, organizations can protect themselves from this and similar vulnerabilities.
Source: SecurityWeek — 2026-09-18