DevSecOps Engineer: 2026-09-19

1. Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

   The Hacker News, 2026-09-19. Read, 3 min.

   CVE-2026-58138, CVSS 9.8, lets an unauthenticated attacker submit a crafted workflow definition to the Orkes Conductor API and escape unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true), reaching OS command execution through the INLINE, LAMBDA, DO_WHILE and SWITCH task types. It affects versions 3.21.21 before 3.30.2. Fortinet reports attackers actively targeting Conductor servers, having blocked nearly 7,000 attempts between 2 and 9 September including 1,290 in one 24-hour span, a 132 percent increase; the majority of that activity is said to have originated from Germany, Hong Kong, Indonesia, the UAE and India. The fix is to upgrade to 3.30.2 or later and, where that is not immediate, to restrict external API access and monitor for suspicious workflow submissions.

   Why it matters for this role: If Conductor runs anywhere in your pipeline or orchestration stack, schedule the upgrade to 3.30.2 this week and take the workflow API off the internet until it lands. Check whether your GraalVM evaluators are configured with HostAccess.ALL or allowAllAccess(true), since that setting is what makes the escape possible.

DevSecOps Engineer