The Orkes Conductor workflow orchestration platform versions from 3.21.21 up to 3.30.2 contain a critical vulnerability CVE-2026-58138 (CVSS v4: 9.3) that allows a remote unauthenticated attacker to execute arbitrary operating system commands. According to Fortinet, the vulnerability is being actively exploited. Organizations using affected versions must immediately update to version 3.30.2 or restrict external access to Conductor API endpoints.
Exploitation mechanism
The vulnerability is related to insecure configuration of built-in expression evaluators based on GraalVM. According to the description in the GitHub Advisory, an attacker sends specially crafted workflow definitions containing malicious JavaScript or Python expressions to the Conductor workflow API endpoint. This occurs before authentication is enforced, which makes the vulnerability particularly dangerous.
The root cause is that GraalVM evaluators can be configured with HostAccess.ALL or allowAllAccess(true), granting unrestricted access to the host system. Using the INLINE, LAMBDA, DO_WHILE, and SWITCH task types, an attacker can invoke arbitrary system commands via Java reflection or direct subprocess calls. The commands execute with the privileges of the Conductor process.
A key aspect: the attack does not require credentials or any prior access to the system. Network reachability of the workflow API endpoint alone is enough — which makes any internet-exposed Conductor instance a potential target.
Exploitation status
In its FortiRecon report, Fortinet classifies CVE-2026-58138 as an actively exploited vulnerability. The company reports observing attacks in which threat actors send crafted workflow definitions with JavaScript or Python expressions to Conductor servers.
Several important caveats should be noted. The data on attack volumes (number of blocked attempts, geographic distribution) cited in the original The Hacker News material were not independently confirmed during verification. Similarly, statements attributed to Previdian and Empirical Security could not be cross-checked against independent sources. Therefore, specific figures for attacker activity should be treated with caution.
At the same time, Fortinet notes that at this point, exploitation of CVE-2026-58138 is not associated with any ransomware groups or APT groups. The vulnerability is also not included in the CISA Known Exploited Vulnerabilities (KEV) catalog.
How the fix works
Analysis of commits in the project repository shows that the fix in Conductor 3.30.2 specifically eliminates the primitive used for exploitation. The developers implemented multi-layered protection:
- Blocking access to sensitive Java classes in the JavaScript evaluator
- Removing unrestricted host access in the Python evaluator
- Disabling process creation, native access, file and network I/O, access to environment variables, and loading host classes in GraalJS
The project also added a dedicated test, testRCEExpressionBlockedForJavascript, confirming that the fix has been validated against the specific attack vector that uses JavaScript expressions for remote code execution.
This approach to remediation — blocking specific evaluator capabilities rather than simply adding an authentication check — indicates that the developers aimed to address the problem at the architectural level, not just close a single exploit path.
Who is at risk
The vulnerability affects organizations using Orkes Conductor versions from 3.21.21 to 3.30.2 (not including). The highest risk is for instances whose workflow API is accessible from external networks. Since the attack does not require authentication, any exposed Conductor endpoint is a potential entry point for full server compromise with Conductor process privileges.
Recommendations
- Update: install Conductor version 3.30.2 or later — this is the top-priority action
- Access restriction: if immediate updating is impossible, block external access to workflow API endpoints and place Conductor instances behind network access control mechanisms
- Monitoring: monitor for suspicious workflow definition submissions and unexpected command execution on Conductor servers
- Patch validation coverage: when validating the fix, ensure that both exploitation paths are blocked — via JavaScript/GraalJS and via the Python evaluator, including attempts to use Java reflection, process creation, and subprocess invocation
We have previously covered Fortinet reports in the context of other vulnerabilities — for example, in our article on the FortiSandbox vulnerability.
Given that Fortinet is recording active exploitation and the attack vector does not require authentication while allowing arbitrary OS command execution, organizations with internet-accessible Conductor instances should treat updating to version 3.30.2 as a top-priority task. If immediate updating is impossible, isolate workflow API endpoints from external access within hours, not days.
