Orkes Conductor, the open source engine that enterprises lean on to sequence microservices, long-running jobs and AI agents, has spent at least a month under active attack. The flaw behind it is CVE-2026-58138, a remote code execution bug rated 9.8. No login is required to reach it – a hostile inline workflow definition pushed to the workflow API will do.
The escape comes down to a sandbox that was never switched on. Empirical Security describes it plainly: “An INLINE task (and LAMBDA, DO_WHILE, and SWITCH tasks) evaluates a user-supplied JavaScript or Python expression, and Conductor builds that evaluator on a GraalVM context configured with HostAccess.ALL.” Isolation off means attacker-supplied code lands in the Java runtime as operating system commands, executed under the Conductor process, which is frequently root.
A stock install offers no obstacle at all. The open source server enforces no authentication and leaves the workflow API open, so one unauthenticated request is enough to register a workflow carrying a hostile task and start it.
June brought a fix in Conductor 3.30.2, but the door did not stay shut. PoC code surfaced in early August; exploitation soon followed. Empirical Security spotted live attacks on August 21. Fortinet issued an outbreak alert after logging roughly 1,300 exploitation attempts across September 8 and 9.
Two moves close the exposure: move to Conductor 3.30.2 or later, and take the workflow API off the public internet behind a firewall. Teams should also sift instances for hostile workflow submissions and unexpected command execution – a compromised server looks entirely normal until somebody reads the logs.
