Orkes Conductor CVE-2026-58138

Exploitation requires that the target Conductor (3.21.21 through 3.30.1) expose its workflow API to the attacker and that its embedded GraalVM JavaScript/Python evaluators be configured unsandboxed with HostAccess.ALL or allowAllAccess(true) - that misconfiguration is the decisive prerequisite. Given that, an attacker needs only to submit an inline workflow definition using INLINE, LAMBDA, DO_WHILE, or SWITCH task types carrying a malicious script expression, with no credentials (PR:N), no user interaction (UI:N), and network access only. Limiting factors: instances that restrict GraalVM host access, that do not expose the workflow definition endpoint to untrusted networks, or that have upgraded to 3.30.2+ are not exploitable; the dependence on the unsandboxed evaluator configuration means default-hardened deployments may be safe.

All available signals point to a genuine high priority rather than a paper-tiger CVSS. The CVSS 4.0 base of 9.3 (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) describes network-reachable, pre-authentication, no-interaction RCE with full confidentiality/integrity/availability loss - the worst practical profile. The one important nuance is the description's stated prerequisite: exploitation depends on the GraalVM evaluators being configured unsandboxed (HostAccess.ALL / allowAllAccess(true)), which is a deployment/configuration condition the vendor's CVSS does not reflect as added complexity; in my independent view this warrants AC:H/AT:P. No EPSS score was supplied, and the input contains no KEV flag and no explicit POC flag, so this is not confirmed actively exploited and no public exploit is identified - the risk is driven by ease of exploitation and exposure, not by observed in-the-wild activity. Given that Conductor APIs are often network-exposed in microservices environments, instances running the vulnerable config should be treated as critical and patched immediately.

An attacker who can reach a Conductor instance's workflow API submits a crafted inline workflow whose INLINE or LAMBDA task contains a JavaScript or Python expression that uses Java reflection to instantiate a process and run shell commands. Because evaluation happens pre-authentication on an unsandboxed GraalVM context, the command executes with the privileges of the Conductor JVM, giving the attacker server-side code execution. No public exploit code is identified, but the technique is well documented in the VulnCheck advisory.