Orkes Conductor (workflow and AI-agent orchestrator, 3,000+ enterprises) — CVE-2026-58138, CVSS 9.8: an unauthenticated POST of a workflow definition with an INLINE/LAMBDA/DO_WHILE/SWITCH expression runs OS commands through an unsandboxed GraalVM evaluator; fixed 3.30.2 in June without a security label, PoC public in August, exploited in the wild since 2026-08-21 with ~1,300 attempts blocked on 09-08/09

View raw markdownEdit on GitHub ↗

TL;DR

Conductor (Netflix-origin, now Orkes / conductor-oss) is the workflow engine that a growing share of teams use to orchestrate microservices and AI agents; Orkes says it runs in 3,000+ enterprises including LinkedIn, Twilio and Quest Diagnostics. CVE-2026-58138 (VulnCheck CNA, published 2026-06-30; CVSS 3.1 9.8 / 4.0 9.3; CWE-94): Conductor 3.21.21 through 3.30.1 "allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication," because the GraalVM evaluators behind INLINE, LAMBDA, DO_WHILE and SWITCH tasks ran with HostAccess.ALL / allowAllAccess(true) — no sandbox, so Java reflection or a subprocess call reaches the OS as the Conductor process (often root). The fix shipped in 3.30.2 on 2026-06-03 with no security label; 3.30.0/3.30.1 are only partially fixed. A public exploit appeared in early August; Empirical Security saw in-the-wild attacks from 2026-08-21, and Fortinet blocked ~1,300 attempts on 2026-09-08/09. SecurityWeek reported continuing exploitation on 2026-09-18. If your agents' tool calls, retries and human-approval steps are Conductor workflows, an attacker with this bug owns the orchestrator and every credential its workers hold. Upgrade to 3.30.2+, put authentication in front of the API, and hunt for unexpected child processes of the Conductor JVM.

What happened

The bug. Conductor lets workflow authors embed small JavaScript (or Python) expressions in task definitions to transform data, branch (SWITCH), loop (DO_WHILE) or compute inline (INLINE, LAMBDA). Those expressions were evaluated on a GraalVM polyglot context configured with host access fully open, which turns "evaluate this expression" into "run this code on the JVM with the JVM's privileges." Because the workflow-definition API accepted definitions before authentication, anyone who could reach the port could submit a workflow whose expression reaches java.lang.Runtime or a subprocess. NVD/VulnCheck: "Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls." Credit: seqradev (VulnCheck advisory).

Versions. Affected 3.21.21 ≤ v ≤ 3.30.1; fixed 3.30.2 (commits 87a7d96a… and c691e35e… in conductor-oss/conductor, release tag v3.30.2). Empirical Security's note: 3.30.0 and 3.30.1 "contain only partial fixes; 3.30.2 is required." The fix shipped 2026-06-03 without being labelled a security release, and the CVE followed on 06-30 — a silent-patch window of four weeks during which upgraders had no reason to prioritise it.

Exploitation timeline. Early August: proof-of-concept code published (Exploit-DB carries one entry; a working exploit targets 3.23.0). 2026-08-21: Empirical Security identifies in-the-wild attacks, recurring thereafter. 2026-09-08/09: Fortinet's FortiGuard blocks ~1,300 exploitation attempts and issues an Outbreak Alert. 2026-09-18: SecurityWeek reports exploitation ongoing. EPSS 0.091 (94th percentile) per Empirical; not on CISA KEV as of the 2026-09-18 feed.

Why an orchestrator matters for this audience. Conductor is marketed as "a unified enterprise framework for orchestrating microservices, workflows, and AI agents" (SecurityWeek's description). In an agent deployment the orchestrator holds the worker credentials, the model-provider keys passed through task inputs, and the approval gates between an agent's plan and its side effects. An unauthenticated RCE here is the same shape as the n8n, Flowise and Langflow entries — expression evaluation in a workflow tool that was exposed to the network with the sandbox off — and, like those, it went from CVE to mass exploitation in weeks. Empirical's title says it: "The 9.8 Nobody Knows They Are Running."

Sources and status. VulnCheck (CNA and researcher-side advisory) and NVD carry the record; Empirical Security's September write-up and SecurityWeek (quoting Fortinet) independently document exploitation. Status active because exploitation is current and the population of unpatched, internet-reachable instances is what the attackers are working through.

Am I affected?

# Version: the Conductor UI/API reports it; anything below 3.30.2 is vulnerable
C="$CONDUCTOR_URL"   # e.g. the host:8080 your workers point at
curl -s "$C/api/health" 2>/dev/null; curl -s "$C/api/metadata/workflow" 2>/dev/null | head -c 200
# Is the API reachable without auth?  If the metadata/workflow endpoints answer without a token, you are exposed.
# Hunt: workflow definitions with INLINE / LAMBDA / DO_WHILE / SWITCH tasks whose expressions reference Java classes or process spawning
curl -s "$C/api/metadata/workflow" | jq -r '.[] | select(.tasks[]?.type | IN("INLINE","LAMBDA","DO_WHILE","SWITCH")) | .name' 2>/dev/null | sort -u
# Host: unexpected child processes of the Conductor JVM (shells, curl, wget, python) are the exploitation signal
ps -eo pid,ppid,comm,args | grep -E 'conductor|java' | head

Empirical's exposure tip for defenders inventorying their own estate: instances announce themselves with a "Conductor UI" page title.

If you are affected

  • Upgrade to 3.30.2 or later and restart; then treat the host as compromised if it was reachable from the internet after early August: playbooks/if-your-webapp-was-compromised.md.
  • Rotate every credential the orchestrator or its workers held (queue, database, cloud, model-provider keys): playbooks/rotating-cloud-credentials.md.
  • Review workflow definitions created or modified since 2026-08-01 for attacker-planted tasks — persistence in a workflow engine is a scheduled workflow.

Update 2026-10-13: a second, unrelated Conductor CVE, this time in the AI module's MCP client (CVE-2026-109402)

VulDB, acting as CNA, published CVE-2026-109402 on 2026-10-13 at 11:45 UTC: in conductor-oss 3.22.0, the MCPService.listTools function in ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java takes an mcpServer argument whose manipulation "results in server-side request forgery," reachable remotely. VulDB's scores are CVSS 4.0 5.3 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L) and 3.1 6.3, with PR:L, so an authenticated caller. The record says "the exploit has been made public and could be used." The VulDB page itself returned 403 to this sweep, so the record is the only text. The release page shows pre-releases v3.33.0-rc11 (2026-10-05) and v3.33.0-rc12 (2026-10-12) each carrying a "fix(security)" line about capping the nesting depth of ${...} expressions in ParametersUtils (#1693, #1708); neither mentions MCP or the AI module, and no fix for this record is on file. Why it matters here: the AI module is the part of Conductor that calls model providers and MCP servers on behalf of workflows, so an SSRF in its tool-listing path is a request from the orchestrator's network position with the orchestrator's credentials. Treat the Conductor host's egress the way the GraalVM bug made you treat its ingress, and keep MCP server definitions in workflow metadata under the same review as tasks. Status of this file is unchanged; the GraalVM RCE remains the exploited bug.

Prevention

  • Never expose an orchestrator's API without an authenticating reverse proxy; network-isolate it from the internet. prevention/agent-sandboxing.md, prevention/ci-cd-hardening.md.
  • Treat "expression evaluation" features in workflow/agent tools as code execution and check how they are sandboxed before enabling them.
  • Subscribe to the project's releases, not only its security advisories — this fix shipped without a label.

Sources