CVE-2026-58138
published 2026-06-30CVE-2026-58138: Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS…
PriorityP190critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
9.14%
94.9th percentile
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| conductor-oss | conductor | >= 3.21.21 < 3.30.2 | 3.30.2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv4.09.3CRITICALCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
conductor-oss conductor up to 3.30.1 Workflow API Endpoint code injection (EDB-52633)
vuldb·2026-08-18·CVSS 9.8
CVE-2026-58138 [CRITICAL] conductor-oss conductor up to 3.30.1 Workflow API Endpoint code injection (EDB-52633)
A vulnerability marked as critical has been reported in conductor-oss conductor up to 3.30.1. Affected by this issue is some unknown functionality of the component Workflow API Endpoint. The manipulation leads to code injection.
This vulnerability is listed as CVE-2026-58138. The attack may be initiated remotely. In addition, an exploit is available.
It is suggested to upgrade the affected component.
GHSA
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow defini
ghsa_unreviewed·2026-06-30
CVE-2026-58138 [CRITICAL] CWE-94 Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow defini
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
VulnCheck
netflix conductor Improper Control of Generation of Code ('Code Injection')
vulncheck·2026·CVSS 9.8
CVE-2026-58138 [CRITICAL] netflix conductor Improper Control of Generation of Code ('Code Injection')
netflix conductor Improper Control of Generation of Code ('Code Injection')
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
Affected: netflix conductor
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or miti
No detection rules found.
Exploit-DB
OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
exploitdb·2026-08-10·CVSS 9.8
CVE-2026-58138 [CRITICAL] OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
---
#!/usr/bin/env python3
# Exploit Title: OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
# CVE: CVE-2026-58138
# Date: 2026-07-10
# Exploit Author: Mohammed Idrees Banyamer
# Author Country: Jordan
# Instagram: @banyamer_security
# Author GitHub: https://github.com/mbanyamer
# Author Blog : https://banyamersecurity.com/blog/
# Vendor Homepage: https://orkes.io/
# Software Link: https://github.com/conductor-oss/conductor
# Affected: Orkes Conductor / Conductor OSS 3.21.21 [-c CMD]
#
# Examples:
# python3 exploit.py http://127.0.0.1:8080
# python3 exploit.py http://target:8080 -c "whoami; id; cat /etc/passwd"
#
# Options:
# target Conductor API base URL (e.g. http://127.0.0.1:8080)
# -c, --cmd Command to execute
Nuclei
Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution
nuclei·CVSS 9.8
CVE-2026-58138 [CRITICAL] Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution
Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution
Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to java.lang.Runtime and execute arbitrary operating system commands through the workflow API.
Template:
id: CVE-2026-58138
info:
name: Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution
author: aryu-ru
severity: critical
description: |
Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with H
No writeups or analysis indexed.
https://github.com/conductor-oss/conductor/commit/87a7d96aabbb706d6e84f812b93da5165028d18fhttps://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1https://github.com/conductor-oss/conductor/releases/tag/v3.30.2https://www.cve.org/CVERecord?id=CVE-2025-26074https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators
2026-06-30
Published
Exploited in the wild