Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability

CVE-2026-58138 is an unauthenticated remote code execution vulnerability in Orkes Conductor (and Netflix Conductor OSS) versions 3.21.21 through 3.30.1. The INLINE, LAMBDA, DO_WHILE, and SWITCH task types evaluate user-supplied JavaScript or Python expressions inside a GraalVM context configured with HostAccess.ALL — effectively giving every expression full access to the Java runtime. An attacker submits a single unauthenticated POST to /api/metadata/workflow containing a workflow definition with a malicious INLINE task, triggers it via /api/workflow/{name}, and the GraalVM evaluator happily calls java.lang.Runtime.exec() to run arbitrary OS commands as the Conductor process — which in containerized deployments frequently runs as root. No credentials, no user interaction, no complexity. One HTTP request to register, one to fire.

The vendor's CRITICAL 9.8 rating is honest and, unusually, undersells no aspect of the real risk. This is textbook pre-auth RCE: network-reachable, zero-click, trivially weaponized. Multiple public PoCs landed within weeks of disclosure (9 GitHub repos, 3 weaponized, plus Exploit-DB EDB-52633). Active exploitation was confirmed by Empirical Security on August 21, 2026, and Fortinet blocked approximately 7,000 attempts between September 2–9, with attack traffic originating from Germany, Hong Kong, Indonesia, the U.A.E., and India. The only reason this isn't on CISA KEV yet is bureaucratic latency — the exploitation evidence already meets the listing criteria.

1. Place Conductor API behind an authenticated reverse proxy immediately — The root cause is unauthenticated API access. Deploy an authenticating reverse proxy (NGINX with OIDC, Envoy with ext_authz, or your API gateway) in front of /api/metadata/workflow and /api/workflow/* endpoints. This is your noisgate mitigation SLA action — deploy within 3 days. This single control eliminates the entire attack chain regardless of patch status.
2. Restrict network access to Conductor port 8080 — Apply firewall rules or Kubernetes NetworkPolicies to ensure only authorized worker hosts and administrative IPs can reach the Conductor API. Block all internet ingress to port 8080. If you have a WAF, add rules blocking JSON POST bodies containing Runtime, ProcessBuilder, or java.lang.Class.forName to workflow endpoints.
3. Upgrade to Conductor 3.30.2 or later — This is the definitive fix. Note that versions 3.30.0 and 3.30.1 contain incomplete patches — only 3.30.2+ fully resolves the flaw. Per the noisgate remediation SLA for CRITICAL, complete the upgrade within 90 days. Given active exploitation, treat this as urgent — ideally within days, not weeks.
4. Deploy Fortinet IPS signature DB 36.267 if applicable — FortiGate, FortiADC, FortiProxy, FortiNDR, and FortiSASE users should ensure IPS signature database 36.267 is deployed, which includes detection for CVE-2026-58138 exploitation payloads.
5. Audit workflow definitions for embedded secrets — Review all stored workflow definitions in Conductor for hardcoded credentials, API keys, and connection strings. Rotate any secrets found — if the instance was compromised, assume these are exfiltrated. Migrate secrets to a proper secret manager (Vault, AWS Secrets Manager, K8s Secrets with external provider).
6. Enable runtime security monitoring on Conductor containers — Deploy Falco, Sysdig, or equivalent runtime security tooling to alert on shell processes (sh, bash, python) spawned as children of the Conductor Java process. This provides detection even if the exploit bypasses network-level controls.

Run this script from any host with network access to the Conductor instance. No special privileges required. Usage: bash check_cve_2026_58138.sh http://conductor.internal:8080

#!/usr/bin/env bash
# CVE-2026-58138 Vulnerability Checker for Orkes/Netflix Conductor
# Checks whether a Conductor instance is running a vulnerable version.
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -uo pipefail

TARGET="${1:-}"
if [ -z "$TARGET" ]; then
  echo "Usage: $0 <conductor_base_url>"
  echo "Example: $0 http://conductor.internal:8080"
  exit 2
fi

# Strip trailing slash
TARGET="${TARGET%/}"
VERSION=""

# Method 1: OpenAPI / Swagger docs (most reliable for version extraction)
echo "[*] Probing ${TARGET} for Conductor version..."
for ENDPOINT in "/v3/api-docs" "/v2/api-docs" "/swagger-resources"; do
  RESP=$(curl -sk --connect-timeout 5 --max-time 10 "${TARGET}${ENDPOINT}" 2>/dev/null || true)
  if [ -n "$RESP" ]; then
    VER=$(echo "$RESP" | grep -oP '"version"\s*:\s*"([0-9]+\.[0-9]+\.[0-9]+[^"]*)"' | head -1 | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' || true)
    if [ -n "$VER" ]; then
      VERSION="$VER"
      echo "[*] Version found via ${ENDPOINT}: ${VERSION}"
      break
    fi
  fi
done

# Method 2: Try /api/admin/build if available
if [ -z "$VERSION" ]; then
  BUILD=$(curl -sk --connect-timeout 5 --max-time 10 "${TARGET}/api/admin/build" 2>/dev/null || true)
  if [ -n "$BUILD" ]; then
    VER=$(echo "$BUILD" | grep -oP '"version"\s*:\s*"([0-9]+\.[0-9]+\.[0-9]+[^"]*)"' | head -1 | grep -oP '[0-9]+\.[0-9]+\.[0-9]+' || true)
    if [ -n "$VER" ]; then
      VERSION="$VER"
      echo "[*] Version found via /api/admin/build: ${VERSION}"
    fi
  fi
fi

# Method 3: Check if Swagger UI is accessible (exposure indicator)
if [ -z "$VERSION" ]; then
  SWAGGER=$(curl -sk --connect-timeout 5 --max-time 10 -o /dev/null -w "%{http_code}" "${TARGET}/swagger-ui.html" 2>/dev/null || true)
  if [ "$SWAGGER" = "200" ]; then
    echo "[!] Swagger UI is accessible at ${TARGET}/swagger-ui.html (API exposed)"
    echo "[!] Could not extract version automatically."
  fi
fi

if [ -z "$VERSION" ]; then
  echo "UNKNOWN - Could not determine Conductor version from ${TARGET}"
  echo "Manually check: inspect conductor-server JAR version, container image tag,"
  echo "or Maven/Gradle dependency declaration for conductor-core version."
  exit 2
fi

# Parse version: MAJOR.MINOR.PATCH
IFS='.' read -r MAJOR MINOR PATCH <<< "$VERSION"

# Validate parsed values are numeric
if ! [[ "$MAJOR" =~ ^[0-9]+$ ]] || ! [[ "$MINOR" =~ ^[0-9]+$ ]] || ! [[ "$PATCH" =~ ^[0-9]+$ ]]; then
  echo "UNKNOWN - Could not parse version '${VERSION}' into numeric components"
  exit 2
fi

# Vulnerable range: >= 3.21.21 AND < 3.30.2
VULN=0
if [ "$MAJOR" -eq 3 ]; then
  if [ "$MINOR" -gt 30 ]; then
    VULN=0  # 3.31+ is patched
  elif [ "$MINOR" -eq 30 ] && [ "$PATCH" -ge 2 ]; then
    VULN=0  # 3.30.2+ is patched
  elif [ "$MINOR" -gt 21 ] || { [ "$MINOR" -eq 21 ] && [ "$PATCH" -ge 21 ]; }; then
    VULN=1  # 3.21.21 through 3.30.1
  else
    VULN=0  # < 3.21.21 is not affected
  fi
elif [ "$MAJOR" -gt 3 ]; then
  VULN=0  # 4.x+ assumed patched
else
  VULN=0  # < 3.x not in vulnerable range
fi

if [ "$VULN" -eq 1 ]; then
  echo "========================================"
  echo "VULNERABLE - Conductor ${VERSION} is affected by CVE-2026-58138"
  echo "Unauthenticated RCE via GraalVM INLINE evaluator"
  echo "Upgrade to 3.30.2+ immediately (3.30.0-3.30.1 have incomplete fixes)"
  echo "========================================"
  exit 1
else
  echo "PATCHED - Conductor ${VERSION} is not in the affected range for CVE-2026-58138"
  exit 0
fi

1. The Hacker News — Critical Pre-Auth RCE in Orkes Conductor Exploited in the Wild
2. SecurityWeek — Critical Orkes Conductor Vulnerability Exploited in Attacks
3. Empirical Security — September 2026 CVE of the Month: CVE-2026-58138
4. FortiGuard Labs — Orkes Conductor Evaluator RCE Outbreak Alert
5. Exploit-DB — OrkesConductor 3.30.2 Unauthenticated RCE (EDB-52633)
6. GitHub PoC — 0xgh057r3c0n/CVE-2026-58138
7. Bellator Cyber — Orkes Conductor RCE CVE-2026-58138: Active Exploits
8. SOCRadar — CVE-2026-58138 CVE Radar