CVE-2026-58138: Critical Pre-Auth RCE in Orkes Conductor Actively Exploited — Detection and Remediation Guide

Fortinet has confirmed active in-the-wild exploitation of CVE-2026-58138, a critical unauthenticated remote code execution vulnerability in the Orkes Conductor workflow orchestration platform. The flaw carries a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3 — the kind of rating reserved for vulnerabilities that are remotely reachable, require no credentials, no user interaction, and yield full code execution on the target.

Affected versions span Orkes Conductor 3.21.21 through all releases before 3.30.2. If your organization runs Conductor to orchestrate microservices, data pipelines, or business process automation — and that instance is reachable from the internet or a broadly accessible internal segment — treat this as an incident, not a patch ticket. Pre-auth RCE in a workflow engine is a worst-case scenario: Conductor typically holds credentials for downstream systems, API tokens, database connection strings, and webhook secrets in its workflow definitions and environment. A single compromised instance is a springboard into everything it touches.

This post breaks down what we know, how to hunt for exploitation, and how to remediate.

Technical Analysis

Affected Products and Versions

Conductor is a Java-based platform (JVM runtime, commonly deployed via Docker/Kubernetes or directly on Linux hosts) that exposes a REST API — by default on TCP/8080 — for workflow and task management. Its typical deployment footprint places it behind an ingress controller or load balancer, but we routinely find Conductor API ports exposed directly during external assessments, particularly in dev/staging environments that were quietly promoted to production use.

How the Attack Works (Defender's Perspective)

The vulnerability allows a remote, unauthenticated attacker to execute arbitrary code on the Conductor server. From a defensive standpoint, the key characteristics of the attack chain are:

1. Reconnaissance/Access: The attacker identifies an exposed Conductor API endpoint — no credentials, session token, or prior access is required. This makes internet-facing instances immediately vulnerable to mass scanning and opportunistic exploitation.
2. Delivery: A crafted request to the Conductor application triggers the vulnerable code path in the JVM process.
3. Execution: Code executes in the context of the Conductor service account. On containerized deployments this is often root inside the container; on bare-metal/VM installs it is typically a dedicated service user — either way, the process has access to workflow definitions, environment variables, and secrets.
4. Post-exploitation: Expect the classic post-RCE behavior set: the Java process spawning shells (/bin/sh, /bin/bash), downloading second-stage payloads with curl/wget, establishing reverse shells, harvesting environment variables and cloud metadata credentials (169.254.169.254), and attempting container escape or lateral movement.

Because Conductor orchestrates other systems by design, its hosts are unusually well-connected. Outbound connectivity from a Conductor server to internal APIs, databases, and message queues is expected — which is exactly why compromised instances are so dangerous, and why egress controls on these hosts matter.

Exploitation Status

This is not theoretical. Fortinet reports active exploitation in the wild. Given the pre-auth nature of the flaw and the 9.8 severity, assume scanning is widespread and that any instance exposed since disclosure has already been probed. Organizations should treat internet-exposed vulnerable instances as presumptively compromised and initiate IR scoping alongside patching. Monitor CISA's Known Exploited Vulnerabilities (KEV) catalog for inclusion, which would trigger federal remediation deadlines and is a strong internal forcing function for patch prioritization.

Detection & Response

The highest-fidelity detection opportunities for this class of Java-application RCE are behavioral: a long-running JVM spawning shell interpreters, download tools, or reconnaissance utilities is almost never legitimate on a Conductor host. Below are detection rules and hunts built on that premise, plus network-level detection for unauthenticated API probing.

Sigma Rules

---
title: Orkes Conductor Java Process Spawning Shell or Download Utility
id: 3f8c2a14-9b71-4e52-a6d3-7c1e5f2a9b08
status: experimental
description: Detects a Java process (typical of Orkes Conductor) spawning shell interpreters or payload retrieval tools, consistent with post-exploitation activity following CVE-2026-58138 pre-auth RCE.
references:
  - https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html
  - https://attack.mitre.org/techniques/T1059/004/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentCommandLine|contains:
      - 'conductor'
      - 'orkes'
    ParentImage|endswith:
      - '/java'
  selection_child_img:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/python'
      - '/python3'
      - '/perl'
      - '/base64'
  condition: selection_parent and selection_child_img
falsepositives:
  - Conductor worker tasks that legitimately invoke system commands (rare; tune to specific task names)
  - Health-check scripts executed by the orchestration layer
level: high
---
title: Reverse Shell or Payload Staging Pattern from JVM Process
id: 8a1d5e67-2c4f-4b89-9e21-6d3a7f0c4b15
status: experimental
description: Detects common reverse shell and payload staging command lines executed by children of Java processes, associated with exploitation of web-facing Java applications such as Orkes Conductor (CVE-2026-58138).
references:
  - https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith: '/java'
  selection_cl:
    CommandLine|contains:
      - '/dev/tcp/'
      - 'bash -i'
      - 'sh -i'
      - 'nc -e'
      - 'mkfifo'
      - 'curl -s http'
      - 'wget -q http'
      - 'chmod +x /tmp/'
      - 'chmod +x /dev/shm/'
  condition: selection_parent and selection_cl
falsepositives:
  - Rare; legitimate JVM management tooling may fetch scripts but should not use interactive shell redirects
level: critical
---
title: Unauthenticated Probing of Conductor REST API Endpoints
id: c42b7f90-5d18-4e36-b8a4-2f9e1c6d3a77
status: experimental
description: Detects high-volume or unauthenticated requests to Conductor API administrative endpoints (workflow/metadata/task APIs) in web access logs, indicating scanning or exploitation attempts against CVE-2026-58138.
references:
  - https://thehackernews.com/2026/09/critical-pre-auth-rce-in-orkes.html
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: webserver
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/api/metadata/workflow'
      - '/api/metadata/taskdefs'
      - '/api/workflow'
      - '/api/admin'
      - '/api/queue'
  selection_status:
    sc-status:
      - 200
      - 201
      - 500
  condition: selection_uri and selection_status
falsepositives:
  - Legitimate orchestration traffic; restrict by source IP or absence of expected auth headers where possible
level: medium

KQL — Microsoft Sentinel / Defender

The following hunt targets process execution telemetry from Linux hosts (via Defender for Endpoint or Syslog/CEF ingestion) where Java-based services spawn shells or download utilities. Run it against any host identified as running Conductor, and broaden to your full Linux estate if asset inventory is uncertain.

// Hunt: Java/Conductor processes spawning shells or download tools (CVE-2026-58138 post-exploitation)
let suspiciousChildren = dynamic(["sh","bash","dash","curl","wget","nc","ncat","python","python3","perl","base64"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "java"
   or InitiatingProcessCommandLine has_any ("conductor", "orkes")
| where FileName in~ (suspiciousChildren)
   or ProcessCommandLine has_any ("/dev/tcp/", "bash -i", "sh -i", "nc -e", "mkfifo", "chmod +x /tmp/", "chmod +x /dev/shm/")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine,
          FileName, ProcessCommandLine, AccountName, InitiatingProcessAccountName
| order by TimeGenerated desc
;
// Companion hunt: outbound connections from Conductor hosts to cloud metadata or rare external IPs
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName =~ "java"
   or InitiatingProcessCommandLine has_any ("conductor", "orkes")
| where RemoteIP == "169.254.169.254"
   or (RemoteIPType == "Public" and RemotePort in (4444, 5555, 6666, 1337, 9001))
| project TimeGenerated, DeviceName, RemoteIP, RemotePort, RemoteUrl,
          InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

For environments forwarding Conductor host logs via Syslog/CEF, a parallel hunt against the Syslog and CommonSecurityLog tables filtering on ProcessName =~ 'java' with child command invocations, and web access logs hitting /api/metadata/ or /api/admin paths without authenticated service principals, will surface the same behaviors.

Velociraptor VQL

Use this hunt across suspected Conductor hosts to enumerate Java processes with suspicious children and active external network connections — useful for both live triage and scoping a presumptive-compromise investigation.

-- Hunt for Java/Conductor processes with shell children and suspicious network connections
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'conductor|orkes' OR Name =~ 'java'

SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime,
       netstat.Pid AS NetPid, netstat.RaddrIP AS RemoteIP,
       netstat.RaddrPort AS RemotePort, netstat.Status AS ConnStatus
FROM foreach(row=procs,
query={
  SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime,
         netstat() AS netstat
  FROM scope()
})
WHERE RemoteIP =~ '^(?!10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)'
   OR CommandLine =~ '/dev/tcp|bash -i|curl|wget'

For deeper triage on a hit, collect the Conductor installation directory, application logs (including access logs for the API port), shell history for the service account, and any files written to /tmp, /dev/shm, or the Conductor working directory within the exposure window.

Remediation Verification Script

The following Bash script inventories Conductor deployments (containerized and bare-metal), reports running versions, checks API exposure, and flags suspicious child processes of the JVM for immediate triage.

#!/usr/bin/env bash
# CVE-2026-58138 — Orkes Conductor exposure and compromise-check script
# Run on Conductor hosts and/or Docker/Kubernetes nodes. Requires root for full coverage.

FIXED_VERSION="3.30.2"
echo "=== [1] Containerized Conductor instances ==="
if command -v docker >/dev/null 2>&1; then
  docker ps --format '{{.ID}} {{.Image}} {{.Names}}' | grep -iE 'conductor|orkes' \
    || echo "No running Conductor containers found via docker ps."
fi

echo ""
echo "=== [2] Kubernetes deployments (requires kubectl context) ==="
if command -v kubectl >/dev/null 2>&1; then
  kubectl get deployments --all-namespaces -o wide 2>/dev/null | grep -iE 'conductor|orkes' \
    || echo "No Conductor deployments found or no cluster access."
fi

echo ""
echo "=== [3] Running Conductor JVM processes and version artifacts ==="
ps -eo pid,user,args | grep -iE 'java.*(conductor|orkes)' | grep -v grep \
  || echo "No Conductor JVM process detected on this host."
find /opt /usr/local /srv /home -maxdepth 4 -iname '*conductor*.jar' 2>/dev/null | while read -r jar; do
  echo "Found artifact: $jar"
  unzip -p "$jar" META-INF/MANIFEST.MF 2>/dev/null | grep -iE 'Implementation-Version|Bundle-Version'
done

echo ""
echo "=== [4] API port exposure check (default 8080) ==="
ss -tlnp 2>/dev/null | grep -E ':8080\b' \
  || echo "Nothing listening on 8080 locally."

echo ""
echo "=== [5] IOC triage: suspicious children of Java processes ==="
for jpid in $(pgrep -f 'java.*(conductor|orkes)'); do
  echo "-- Children of Conductor JVM (PID $jpid):"
  ps --ppid "$jpid" -o pid,user,comm,args 2>/dev/null
done

echo ""
echo "=== [6] IOC triage: recent writes to common staging dirs ==="
find /tmp /dev/shm /var/tmp -type f -mtime -14 -executable 2>/dev/null | head -50

echo ""
echo "=== [7] IOC triage: outbound connections from Java processes ==="
ss -tnp 2>/dev/null | grep -i java

echo ""
echo "=== REMEDIATION REQUIRED ==="
echo "Vulnerable: Orkes Conductor 3.21.21 through releases before ${FIXED_VERSION}"
echo "Action: Upgrade to ${FIXED_VERSION} or later IMMEDIATELY. If the instance was"
echo "internet-reachable, treat as presumptively compromised and begin IR scoping:"
echo "rotate all secrets/tokens stored in workflows, env vars, and connected systems."

Remediation

1. Patch now — this is the only complete fix. Upgrade all Orkes Conductor deployments to version 3.30.2 or later. This applies to self-hosted open-source deployments, Docker images, and Helm chart releases. Pin and verify image digests after upgrade; do not assume latest tags have propagated to your registry mirrors.

2. Assume compromise for exposed instances. Any vulnerable instance reachable from the internet — or from broadly accessible internal networks — since disclosure should be treated as breached until proven otherwise:

• Isolate the host/container from the network (do not power off; preserve memory if forensics are in scope).
• Collect Conductor application and access logs, container logs, and EDR telemetry covering the full exposure window.
• Hunt for the post-exploitation behaviors in the detection section: JVM-spawned shells, payload staging in /tmp or /dev/shm, outbound connections to unfamiliar IPs, and cloud metadata access.

3. Rotate everything Conductor can touch. This is the step most organizations under-scoped in similar Java-platform RCE incidents. Rotate:

• API keys, tokens, and webhook secrets stored in workflow/task definitions.
• Environment variables and Kubernetes secrets mounted into Conductor pods.
• Database credentials, message queue credentials (Redis, Kafka, Postgres), and downstream service accounts Conductor orchestrates.
• Cloud IAM credentials accessible from the host (instance profiles, metadata-service-derived tokens).

4. Reduce the attack surface permanently.

• Place the Conductor API behind authentication (OIDC/reverse proxy auth) and network ACLs — it should never be anonymously reachable.
• Restrict egress from Conductor hosts to an explicit allowlist of required downstream services; block cloud metadata access (169.254.169.254) from the JVM unless explicitly required, and use IMDSv2 with hop-limit controls on AWS.
• Run Conductor as a non-root user with a read-only container filesystem and dropped capabilities where deployment permits.

5. Verify and monitor. Post-patch, confirm the running version via artifact manifest or /api version endpoints, re-run external scans against any previously exposed endpoints, and deploy the Sigma/KQL detections above as standing analytics — pre-auth RCEs in orchestration platforms attract repeat scanning long after the initial disclosure cycle.

6. Track authoritative sources. Monitor the Fortinet advisory/threat research, the Orkes security advisories and release notes, and the CISA KEV catalog for CVE-2026-58138 inclusion, which may impose remediation deadlines on federal agencies and serves as a useful forcing function for commercial patch SLAs.

The Bottom Line

CVE-2026-58138 is the profile of vulnerability that drives breach headlines: unauthenticated, remotely exploitable, actively exploited, and sitting in a platform that holds the keys to your automation infrastructure. Workflow orchestrators are force multipliers for attackers — a single RCE cascades into every system the platform integrates with. Patch to 3.30.2 today, scope for compromise on anything that was exposed, and rotate the secrets. In that order, and without waiting for the change window.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub