Pre-Auth RCE in Orkes Conductor Exploited in the Wild
CVE-2026-58138 exposes a critical unauthenticated remote code execution flaw in Orkes Conductor stemming from an unsandboxed GraalVM evaluator that processes user-supplied workflow definitions without proper isolation or authentication gates. Because no credentials are required to trigger the exploit, any internet-facing Conductor instance is immediately at risk, dramatically lowering the bar for attackers. Active exploitation observed across multiple countries underscores how quickly threat actors weaponize workflow and orchestration platforms, which are often overlooked in patch cycles despite their privileged access to backend systems. Organizations running automation or workflow platforms must treat them with the same urgency as perimeter-facing assets.
Tactical Insight
Immediate actions
- Apply the vendor-released patch or upgrade Orkes Conductor to the latest fixed version as an emergency priority.
- Temporarily restrict public internet access to Conductor instances behind a VPN or firewall allowlist until patching is complete.
- Scan all internet-facing assets for the presence of vulnerable Conductor versions using an authenticated vulnerability scanner.
Configuration hardening
- Enforce authentication and authorization on all Conductor API endpoints, ensuring no endpoints accept unauthenticated workflow submissions.
- Replace or fully sandbox the GraalVM evaluator so that workflow script execution cannot reach the underlying OS shell.
- Apply the principle of least privilege to the service account running Conductor, removing unnecessary OS-level permissions.
Detection measures
- Deploy IDS/IPS signatures (e.g., Fortinet rules) targeting known exploit payloads targeting this CVE on workflow platform traffic.
- Enable detailed audit logging for all workflow definition submissions and alert on anomalous or unexpected OS command patterns.
- Establish continuous monitoring for indicators of compromise (unusual child processes, outbound connections) spawned by the Conductor process.