Orkes Conductor CVE-2026-58138: Exploitation Activity Observed Against Unauthenticated Workflow RCE
1. Basic Information Original Title: September 2026 CVE of the Month: The 9.8 Nobody Knows They Are Running (CVE-2026-58138) Source: Empirical Security Publication Date: September 1, 2026 Updated Date: None Severity: Critical Basis of Severity: Sending malicious workflow definitions to the Conductor OSS Workflow API, which lacks authentication by default, allows OS commands to execute with the privileges of the Conductor process, which is often root in the default container image. Empirical Sec…