A Critical Vulnerability in Orkes Conductor Exposed Organizations to Remote Attacks
A severe vulnerability in the popular open-source framework Orkes Conductor has been exploited by attackers for several weeks, leaving many organizations vulnerable to remote code execution attacks. The flaw, tracked as CVE-2026-58138 with a CVSS score of 9.8, was patched in June but proof-of-concept code targeting it was published in early August.
Orkes Conductor is an enterprise framework that allows organizations to orchestrate microservices, workflows, and AI agents. However, the critical bug affects how Conductor runs scripts inside a workflow, allowing attackers to include malicious JavaScript or Python expressions in inline workflow definitions submitted to the workflow API endpoint. This can invoke arbitrary system commands as the Conductor process, often running with root privileges.
The vulnerability is particularly concerning because it can be exploited without authentication, taking advantage of Orkes Conductor’s default configuration that leaves its workflow API open. According to Empirical Security, an attacker can register a hostile inline task and start it using a single unauthenticated POST request to the workflow API endpoint. This allows malicious code to execute on the system as if it were coming from the Conductor process itself.
Empirical identified in-the-wild attacks targeting this vulnerability on August 21, while Fortinet reported blocking around 1,300 exploitation attempts between September 8 and 9. This week, Fortinet released an outbreak alert warning of ongoing exploitation efforts. In addition to updating to Orkes Conductor version 3.30.2 or later, organizations should take immediate action to restrict external access to the workflow API endpoints and ensure their deployments are behind a firewall.
It’s also crucial for organizations to monitor their instances for suspicious workflow submissions and unauthorized command execution, as well as review systems running vulnerable versions for signs of intrusion. This vulnerability serves as a stark reminder that even with patches in place, exploiting vulnerabilities can take time, and it’s essential for organizations to stay vigilant and proactive in securing their environments.
As the threat landscape continues to evolve, it’s essential for security professionals to be aware of such critical vulnerabilities and take prompt action to mitigate them. By understanding how attackers are exploiting these flaws and taking proactive measures, organizations can better protect themselves against sophisticated attacks.
Source: SecurityWeek — 2026-09-18