CVE-2026-58138 Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
Remote attackers can execute arbitrary OS commands via malicious workflow definitions due to unsandboxed GraalVM evaluators in Orkes Conductor.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58138?
CVE-2026-58138 is a critical code injection vulnerability in conductor-oss conductor, published on 30 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
Weakness: CWE-94
Which versions are affected by CVE-2026-58138?
How do I fix CVE-2026-58138?
No fix has been published for CVE-2026-58138 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-58138 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58138 exists.
Public exploit code: 1 Exploit-DB entry, 1 Nuclei template and 7 proofs of concept on GitHub.
Sources
Also known as GHSA-7x5q-8f6h-rjrc.