Which versions of Orkes Conductor are affected by CVE-2026-58138?

Orkes Conductor (versions 3.21.21-3.30.1) contains a critical unauthenticated remote code execution vulnerability allowing remote attackers to execute arbitrary OS commands on affected systems…. A patch is available.

Is there a public PoC exploit available for CVE-2026-58138?

Yes, a public proof-of-concept exploit is available for CVE-2026-58138. Prioritise patching immediately. EPSS: 0.9%.

How to fix or mitigate CVE-2026-58138?

Within 24 hours: Inventory all Conductor deployments; determine which versions are running; restrict external network access to the workflow API endpoint using firewall rules or VPN requirement. Within 7 days: Deploy patched version per vendor advisory for all affected instances (3.21.21-3.30.1); verify upgrade completion and API accessibility from authorized networks only. Within 30 days: Review access logs for exploitation attempts; rotate application credentials and secrets that may have been exposed.

Orkes Conductor CVE-2026-58138

Q: What is the CVSS score of CVE-2026-58138?

CVE-2026-58138 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-40377 CRITICAL

Code Injection (CWE-94)

2026-06-30 VulnCheck

GHSA-7x5q-8f6h-rjrc

Code Injection Python Java RCE Conductor

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network pre-auth, no interaction (PR:N/UI:N) yielding full host RCE, but exploitation depends on a non-default unsandboxed GraalVM config, so AC:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 19:22 vuln.today

DescriptionCVE.org

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.

Articles & Coverage 3

medium.com CVE-2026–58138 Jul 26, 2026 News 5 New Python Vulnerabilities - 2 Critical, 3 High Severity Jul 01, 2026 News Critical RCE in Orkes Conductor (Java) - CVE-2026-58138 Jun 30, 2026

AnalysisAI

Unauthenticated remote code execution in Orkes Conductor (conductor-oss) versions 3.21.21 through 3.30.1 lets remote attackers run arbitrary OS commands by POSTing inline workflow definitions to the workflow API before any authentication check. The flaw stems from GraalVM script evaluators left in an unsandboxed state (HostAccess.ALL / allowAllAccess(true)), allowing JavaScript or Python expressions in INLINE, LAMBDA, DO_WHILE, and SWITCH tasks to reach Java reflection and subprocess APIs. Reported by VulnCheck; no public exploit identified at time of analysis, though a detailed vendor/researcher advisory exists.

Technical ContextAI

Conductor is an open-source microservices workflow-orchestration engine (originating from Netflix Conductor, maintained as conductor-oss/Orkes Conductor) that lets users define workflows whose tasks can embed inline script expressions. To evaluate those expressions it embeds GraalVM polyglot script engines for JavaScript and Python. The root cause is CWE-94 (Improper Control of Generation of Code / code injection): when the GraalVM context is created with HostAccess.ALL or allowAllAccess(true), guest scripts are granted full host-Java interop, so attacker-supplied script bodies can use Java reflection (e.g., java.lang.Runtime/ProcessBuilder) or direct subprocess calls to escape the intended sandbox and execute on the host JVM. The affected component per NVD CPE is cpe:2.3:a:conductor-oss:conductor (all versions in the stated range up to the fix).

RemediationAI

Vendor-released patch: upgrade to Conductor v3.30.2 or later, which contains the hardening commits (87a7d96 and c691e35) referenced in the release at https://github.com/conductor-oss/conductor/releases/tag/v3.30.2. Where immediate upgrade is not possible, the most effective compensating control targets the root cause: reconfigure the GraalVM script evaluators away from HostAccess.ALL / allowAllAccess(true) to a restricted host-access policy so guest scripts cannot reach Java host objects, accepting that legitimate workflows relying on broad host interop may break and need rework. As additional measures, disable or restrict the INLINE, LAMBDA, DO_WHILE, and SWITCH script-evaluating task types if unused, and place the workflow API behind authentication and network controls so the unauthenticated definition-submission endpoint is not reachable from untrusted networks - noting this reduces exposure but does not remove the underlying injection. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators) for specifics before applying config changes.