September 2026 CVE of the Month: The 9.8 Nobody Knows They Are Running (CVE-2026-58138)
Netflix built Conductor to choreograph its microservices and open sourced it in 2016. A decade later the engine has passed 32,000 GitHub stars, found a second life orchestrating AI agents in production, and drawn a $60 million round for the startup that stewards it. The one thing its open-source build still does not ship with is authentication. This month's pick is what an attacker does with that open door before you close it.
This month's CVE of the Month is CVE-2026-58138
From the advisory description
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
CVE-2026-58138 was published June 30, 2026, affecting Orkes / conductor-oss (Conductor, the open-source workflow engine).
At a glance
Why CVE-2026-58138 matters
The Empirical Foundation model places it in the 99th percentile of all scored CVEs.
Empirical's exploitation telemetry shows in-the-wild exploitation within the last 7 days (most recent activity August 21, 2026). This signal comes from our own sensor network.
Public exploit code exists: 1 Exploit-DB entry.
Conductor is not a household name in the security org, but it is a load-bearing one in engineering, and its reach is the whole problem. Orkes, the startup that stewards the project and raised that $60 million round in April 2026, says Conductor now runs inside more than 3,000 enterprises, a list it publicly names as including LinkedIn, Twilio, and Quest Diagnostics (those are the vendor's figures, not ours). Because the core is open source, many more installs never appear on anyone's inventory at all. Wherever it runs, it sits at the center of things, firing the tasks that move data between systems. A workflow engine with that reach and no authentication by default is a large and quiet attack surface.
The bug is in how Conductor runs the little scripts inside a workflow. An INLINE task (and LAMBDA, DO_WHILE, and SWITCH tasks) evaluates a user-supplied JavaScript or Python expression, and Conductor built that evaluator on a GraalVM context configured with HostAccess.ALL. That setting turns the sandbox off. From the object bound into the script, an attacker reflects across to java.lang.Runtime and calls out to the operating system. No login stands in the way, because the open-source server enforces no authentication by default and leaves its workflow API open. A single unauthenticated POST registers a workflow with a hostile INLINE task and starts it. The commands then run as the Conductor process, which in the default container image is often root. Full control of the orchestration layer means control of every system its workflows can already reach.
What's driving the score?
| Indicator | Weight | Detail |
|---|---|---|
| Exploitation | +4.08 | 1-7 days (2, wt=4); 8-30 days (3, wt=0.8); 31-90 days (1, wt=0.5) |
| Threat Intel | +0.40 | Nuclei (1, wt=0.5) |
| Vuln Attributes | +0.25 | Nothing Interesting |
| References | +0.12 | CVE Refs (5, wt=0.01) |
| Exploit Code | -0.11 | ExploitDB (1, wt=-0.09); GitHub (0, wt=-0.02); Metasploit (0, wt=-0.001) |
| Vendor | +0.02 | Nothing Significant |
| Chatter | +0.02 | Sightings (0, wt=0.007) |
Weights are the model's attribution for each indicator group; the counts shown are inputs, not count-times-weight arithmetic.
Bottom line
This is an unusual pick for a column about the queue's blind spots, because nothing here disagrees. CVSS says 9.8, EPSS sits near the top of its distribution, and our Foundation model puts it in the 99th percentile. Severity was never the problem; discovery is, because this is software most security teams never realize they run.
The fix did not announce itself either. It shipped on June 3 in release 3.30.2, described in the notes only as restricting GraalVM JavaScript further, with no security label and no CVE attached. The CVE was not published until June 30, almost four weeks later. For that month, and for every environment that still cannot see the asset, the advisory-driven feeds a patch program consumes had nothing to point at.
Our telemetry closes the gap from the other side. We see exploitation activity against this CVE from a source in our sensor network, and we see it recurring: activity in each of the last three observation windows, most recently on August 21. Attackers located the open door while the software behind it was still invisible to the people who own it. That is the lesson worth keeping. The vulnerability that hurts you is not always the one with the low score that slips under a threshold. Sometimes it is the 9.8 that never made it onto the list.
Mitigation status
A fixed release exists, so this is a patch-first response, with a real caveat: patching only helps the instances you can find.
Upgrade
Move to Conductor 3.30.2 or later. The fix stops rebuilding the script evaluator on HostAccess.ALL, blocks the reflection and process classes an exploit needs (Runtime, ProcessBuilder, Process, System, and the reflection primitives), and disables host class loading, native access, thread and process creation, and file and environment access in the GraalVM context. The Python evaluator no longer runs with allowAllAccess(true).
Do not stop at 3.30.0 or 3.30.1. Those shipped only a partial blocklist; 3.30.2 is the complete fix.
Find it first, because this is the hard part
Do not wait for a scanner finding. As of this writing there is no credentialed Tenable or Qualys plugin for CVE-2026-58138, so a clean scan report says nothing about your exposure here. This is the discovery gap in practice.
Conductor rarely shows up in inventory as "Conductor." Hunt for the web UI (page title Conductor UI), the API on its default port 8080, and the Swagger explorer at /swagger-ui. The internet-exposure query is http.title:"Conductor UI" on Shodan or Censys.
Check container and orchestration layers directly: conductoross/conductor images, Helm charts, and anything a platform, data, or ML team deployed for workflow or agent orchestration.
Reduce the blast radius where you cannot upgrade today
The open-source server enforces no authentication and exposes every API endpoint. Put it behind a reverse proxy that requires authentication (Nginx or Envoy) or a Spring Boot security filter, and take the API off any untrusted network.
On builds before 3.30.2 there is no configuration flag we are aware of that safely disables the INLINE and LAMBDA script evaluators, so treat network isolation as the lever you have. Restrict who can reach /api/metadata/workflow and /api/workflow.
Hunt
Review workflow definitions for INLINE, LAMBDA, DO_WHILE, or SWITCH tasks whose evaluatorType is javascript, graaljs, or python and whose expression references getClass, forName, Runtime, ProcessBuilder, or array reflection.
Watch the Conductor JVM for child processes it should never spawn, such as sh -c or cmd.
A verified Nuclei template (CVE-2026-58138) exists for detection and validation.
References
https://nvd.nist.gov/vuln/detail/CVE-2026-58138
https://euvd.enisa.europa.eu/enisa/EUVD-2026-40377
https://github.com/conductor-oss/conductor/releases/tag/v3.30.2
https://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1
https://docs.conductor-oss.org/devguide/running/docker.html
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-58138.yaml
https://www.exploit-db.com/exploits/52633
Every month we pick one CVE, put the signals side by side (exploitation telemetry, EPSS, KEV, exploit code), and show our work. Empirical customers get the same signals across their entire vulnerability portfolio, every day. See how your portfolio ranks at empiricalsecurity.com.
