CVE-2026-58138 json
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
published 2026-06-30 4 mo ago modified 2026-11-08 24 h ago also EUVD-2026-40377
- cvss
- 9.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 9.1%
- EPSS 9.1% chance of exploitation in 30 days, percentile 95%
- public exploits
- 1
- Exploit-DB, plus a Nuclei check
Summary
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
Patch / fix
- conductor-oss conductor 3.30.2
Timeline
- Published
- First public exploit (EDB-52633)
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 4 mo ago
Exploit prediction
9.14% chance of exploitation in the next 30 days, higher than 95% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-52633 OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution webapps, 2026-08-10
- Nuclei template Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution nuclei detection template
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| CNA | 3.1 | 9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 9.3 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected products
- conductor-oss conductor
Classification
- Weakness
-
- CWE-94 Improper Control of Generation of Code
References
-
github.com
/conductor-oss/conductor/commit/87a7d96aabbb706d6e84f812b93da5165028d18f
patch
-
github.com
/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1
patch
-
github.com
/conductor-oss/conductor/releases/tag/v3.30.2
release-notes
- cve.org /CVERecord?id=CVE-2025-26074
-
vulncheck.com
/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators
third-party-advisory
Sources
- CVE List CVE-2026-58138
- NVD CVE-2026-58138
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.