Conductor Pre-Auth RCE Is Being Exploited in the Wild

Conductor Pre-Auth RCE Is Being Exploited in the Wild

If you run Conductor - the open-source orchestration engine behind Orkes that teams use to coordinate microservices, workflows, and AI agents - there is one version number you need to know right now: 3.30.2. Everything before it is a pre-authentication remote code execution door, and attackers have been walking through it since August.

The flaw is CVE-2026-58138: a critical unauthenticated RCE with a CVSS v3.1 score of 9.8 (9.3 under CVSS v4). No login, no user interaction, no special port. An attacker just submits a crafted workflow definition to the workflow API endpoint, the server evaluates a malicious JavaScript or Python expression, and runs arbitrary OS commands as the Conductor process - which in the default container image is often root.

Fortinet's outbreak alert shows this is not theoretical. Between September 2 and 9, 2026, FortiGuard blocked nearly 7,000 attack attempts, and the daily rate shot up 132% - 1,290 attempts in the 24 hours to September 9 alone. Telemetry from Previdian logs three honeypot hits since July 24 from two IPs, and Empirical Security detected in-the-wild exploitation as recently as August 21.

Why an "expression evaluator" becomes a shell

Conductor lets workflow definitions run inline scripts. Task types like INLINE, LAMBDA, DO_WHILE, and SWITCH take a user-supplied expression and evaluate it - normally meant for quick data transformations inside a workflow.

The bug is in how Conductor builds the evaluator. It creates a GraalVM context, and for JavaScript it does so with full host access enabled - the sandbox effectively turned off:

// ScriptEvaluator.java (Conductor <= 3.29.x) - the vulnerable configuration
return Context.newBuilder("js")
        .allowHostAccess(HostAccess.ALL)   // full host interop: no sandbox
        .build();

The Python evaluator is equivalent, built with allowAllAccess(true). HostAccess.ALL lets a script call any method or field on Java host objects, and the INLINE task binds its input as $ - a real Java object. From there the chain to the OS is short, via reflection:

// A workflow INLINE expression styled after the described exploit chain.
// $ is the task input object; the script reflects across to java.lang.Runtime.
$.getClass().getClass()                       // -> java.lang.Class
  .forName("java.lang.Runtime")                // load the Runtime class
  .getRuntime()
  .exec("bash -c 'id > /tmp/pwned'")           // arbitrary OS command

Because the checkbox the attacker never ticks is authentication - the community API is open by default - the whole attack is two unauthenticated HTTP calls: register a workflow whose INLINE task carries the hostile expression, then start it. The command runs with whatever privileges the Conductor process has.

You may already be scanning for this

A public exploit for CVE-2026-58138 was published on Exploit-DB on August 9, 2026 (EDB-52633), and further proof-of-concept code exists for the plain HostAccess.ALL configuration. FortiGuard says weaponized material being public "increases the likelihood of opportunistic scanning and exploitation of exposed deployments," and its telemetry confirms the scanning is happening now. The majority of the observed attack traffic comes from Germany, Hong Kong, Indonesia, the UAE, and India.

Patch: do not stop at 3.30.0 or 3.30.1

The fix landed in Conductor 3.30.2 (commits 87a7d96 and c691e35). A warning from Empirical Security: the 3.30.0 and 3.30.1 line shipped only a partial blocklist that stops reflection but is not the complete hardening. Only 3.30.2 blocks the reflection and process classes the exploit needs (Runtime, ProcessBuilder, Process, System), disables host class loading, native access, thread and process creation, and file and environment access, and stops running the Python evaluator with allowAllAccess(true).

# upgrade a self-built Conductor to the fixed release (conductor-oss)
git clone --branch v3.30.2 https://github.com/conductor-oss/conductor.git

Upgrade first. If you genuinely cannot patch immediately:

• Stop exposing the API. Put the Conductor endpoints behind a reverse proxy that enforces authentication (Nginx/Envoy or a Spring Security filter) and take /api/metadata/workflow and /api/workflow off any untrusted network. There is no safe configuration flag that disables the INLINE/LAMBDA evaluators before 3.30.2 - network isolation is your lever.
• Run as least privilege. Don't run the server as root; a non-root, least-privilege user limits what a successful exec can reach. If your instance controls other systems (that is the whole point of an orchestrator), the blast radius is every system its workflows can already reach.
• Monitor. Watch workflow definitions for INLINE/LAMBDA/DO_WHILE/SWITCH tasks whose evaluatorType is javascript, graaljs, or python with expressions referencing getClass, forName, Runtime, ProcessBuilder, or reflection - and watch the Conductor JVM for child processes it should never spawn, such as sh -c or cmd.

The pattern worth remembering

CVE-2026-58138 is a textbook case of a "scripting sandbox" that was never a sandbox. What makes it dangerous is the compound: an unsandboxed evaluator whose language allows reflection, sitting behind a default-open API, in software whose entire job is to orchestrate access to other systems. Any one of those three conditions is manageable; all three together is a fire.

If your platform runs user-supplied expressions or queries - SQL, eval, a polyglot engine, a regex - check what the evaluator can actually reach and who can submit expressions. We saw the same class of compounding in the Unbound DNSSEC heap overflow (a parser handling untrusted input), and the PaperCut exploitation wave shows how fast scanners adopt a public PoC once it lands. If you run Conductor, treat the 3.30.2 upgrade as a same-day task.

Sources

• NIST NVD: CVE-2026-58138
• VulnCheck: Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
• Fortinet FortiGuard Labs: Orkes Conductor Evaluator Remote Code Execution - Outbreak Alert
• Empirical Security: September 2026 CVE of the Month: The 9.8 Nobody Saw Coming
• SecurityWeek: Critical Orkes Conductor Vulnerability Exploited in Attacks
• conductor-oss (GitHub): Conductor v3.30.2 release
• Previdian: CVE-2026-58138 telemetry