CVE-2026-58138: Improper Control of Generation of Code ('Code Injection') in conductor-oss conductor
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
AI Analysis
Technical Summary
CVE-2026-58138 is a critical remote code execution vulnerability in Orkes Conductor versions 3.21.21 through 3.30.1. It allows unauthenticated attackers to submit inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. The vulnerability exploits unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true), enabling attackers to execute arbitrary OS commands via INLINE, LAMBDA, DO_WHILE, and SWITCH task types using Java reflection or direct subprocess calls. This can lead to full system compromise. The product is cloud-hosted, and a patch is available.
Potential Impact
Successful exploitation results in unauthenticated remote code execution on the affected Orkes Conductor service, allowing attackers to execute arbitrary operating system commands. This can lead to complete system compromise, data breach, or disruption of service. The vulnerability affects the workflow API endpoint before authentication, increasing the risk of exploitation.
Mitigation Recommendations
A patch is available for this vulnerability. Since Orkes Conductor is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance has been updated to version 3.30.2 or later. No additional action is required if the service is managed by the vendor and updated accordingly.
CVE-2026-58138: Improper Control of Generation of Code ('Code Injection') in conductor-oss conductor
Description
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
CVSS v4.0
Score 9.3critical
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-58138 is a critical remote code execution vulnerability in Orkes Conductor versions 3.21.21 through 3.30.1. It allows unauthenticated attackers to submit inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. The vulnerability exploits unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true), enabling attackers to execute arbitrary OS commands via INLINE, LAMBDA, DO_WHILE, and SWITCH task types using Java reflection or direct subprocess calls. This can lead to full system compromise. The product is cloud-hosted, and a patch is available.
Potential Impact
Successful exploitation results in unauthenticated remote code execution on the affected Orkes Conductor service, allowing attackers to execute arbitrary operating system commands. This can lead to complete system compromise, data breach, or disruption of service. The vulnerability affects the workflow API endpoint before authentication, increasing the risk of exploitation.
Mitigation Recommendations
A patch is available for this vulnerability. Since Orkes Conductor is a cloud-hosted service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their service instance has been updated to version 3.30.2 or later. No additional action is required if the service is managed by the vendor and updated accordingly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-06-29T14:13:18.385Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a44103527e9c797193b6df4
Added to database: 06/30/2026, 18:51:33 UTC
Last enriched: 06/30/2026, 19:06:17 UTC
Last updated: 07/01/2026, 04:32:45 UTC
Views: 1078
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.