19 SEP 2026 — Orkes Conductor is an open-source workflow server that organisations use to orchestrate microservices and AI agents. A flaw in it lets an unauthenticated attacker run commands on the server. The fix shipped in June. One security vendor blocked 1,290 attempts in a single day this month.
That gap is the story. Nothing about this flaw is unknown, unpatched or disputed.
What the flaw allows
CVE-2026-58138 carries a CVSS v3.1 base score of 9.8 and a CVSS v4 score of 9.3, both assigned by the National Vulnerability Database.
An attacker submits a workflow definition to the Conductor API without authenticating, and embeds a JavaScript or Python expression inside it. The Hacker News reported that the expression evaluators run under GraalVM with unrestricted host access, letting the expression escape the scripting sandbox and reach the operating system through Java reflection or a direct subprocess call.
The affected task types are INLINE, LAMBDA, DO_WHILE and SWITCH. Versions 3.21.21 through 3.30.1 are vulnerable, and 3.30.2 carries the fix.
Three vendors, three start dates
The firms watching this flaw do not agree on when attacks began. The disagreement matters.
Previdian recorded three exploitation attempts dating back to 24 July. SecurityWeek reported that Empirical Security identified initial attacks on 21 August, and that a proof-of-concept exploit was published in early August.
Those two accounts sit awkwardly together. If the attempts Previdian saw on 24 July were genuine exploitation, they preceded the public proof-of-concept by roughly two weeks, which would point at someone working from the patch rather than from the published exploit. With a sample of only three attempts, the alternative reading, scanning noise that resembles the exploit, is also plausible. Neither firm has published the detail that would settle it.
Where the traffic comes from
Fortinet issued an outbreak alert this week, having blocked close to 7,000 attempts between 2 and 9 September. One 24-hour window carried 1,290 of them, a 132 per cent rise in daily activity.
The firm lists the main sources as Germany, Hong Kong, Indonesia, the United Arab Emirates and India. Two of those five are in this region, which matters for anyone reading from it, but the figure describes where packets originated and not where anyone is sitting. Rented infrastructure is cheap and attackers use it precisely because it relocates them.
Why orchestration servers are worth taking
A workflow engine is an unusually rewarding target, and not because of what it stores. Conductor exists to call other systems. It holds the credentials needed to do that, is trusted by the services it drives, and usually sits deep enough inside a network that traffic leaving it attracts no attention.
Code execution on that host is therefore not the end of an intrusion but the beginning of a convenient one. The orchestration layer reaches the things worth reaching; that is the whole point of deploying it.
The same shape appeared in forged admin tokens hitting WSO2 API gateways patched five months earlier. An integration component with an available patch and an owner who has not applied it is a recurring category, not an unlucky week.
What to check
Confirm the running version is 3.30.2 or later. Confirm whether the workflow API is reachable from the internet. Because the flaw requires no credentials, public exposure is what turns a patch delay into an incident.
The patch is roughly three months old. An organisation that has not applied it has a patching interval longer than the interval attackers needed to weaponise the flaw. That is the number worth knowing internally, regardless of this particular product.
The flaw does not appear in CISA's Known Exploited Vulnerabilities catalogue at the time of writing, so no federal remediation deadline attaches to it. That describes the catalogue, not the risk.
View author profile → · Editorial policy
