CTI · corroborated · 2026-09-19

Critical Orkes Conductor Vulnerability Exploited in Attacks

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1068 Exploitation for Privilege Escalation Privilege Escalation

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• cybersecurefox.com domain · active · corroborated

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Orkes Conductor Unauthenticated RCE via Workflow API - CVE-2026-58138
id: a7f3c2e1-4b8d-4a1e-9c6f-2d3e5f7a8b9c
status: experimental
description: Detects exploitation of CVE-2026-58138 in Orkes Conductor where an unauthenticated attacker submits a malicious workflow definition via the API to achieve remote code execution through GraalVM JavaScript/Python evaluation with HostAccess.ALL.
references:
  - https://securityweek.com/
  - https://thehackernews.com/
  - https://cyberworldops.eu/
author: Tia N. List
date: 2026-09-19
tags:
  - attack.t1190
  - attack.t1059
  - attack.t1068
  - cve.2026.58138
logsource:
  product: any
  service: orkes-conductor
detection:
  selection_api:
    cs_method: POST
    cs_uri_path|contains: '/api/workflow'
  selection_inline:
    cs_method: POST
    cs_uri_path|contains: '/api/workflow'
    cs_request_body|contains: 'inline'
    cs_request_body|contains: 'javascript'
  condition: selection_inline
falsepositives:
  - Legitimate workflow submissions using inline JavaScript (rare in production)
level: high

References

• https://securityweek.com/
• https://cyberworldops.eu/
• https://dev.to/
• https://thehackernews.com/
• https://intel.threadlinqs.com/