---

📌 Overview

CVE-2026-58138 is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting Conductor / Orkes Conductor.

The vulnerability exists in the application's handling of user-controlled script expressions evaluated through GraalVM. Unsafe evaluator configurations can expose host functionality to attacker-controlled expressions.

Under vulnerable configurations, an unauthenticated remote attacker may be able to submit a crafted workflow definition containing malicious expressions and potentially execute commands in the security context of the Conductor process.

⚠️ Severity: CRITICAL — Immediate patching is strongly recommended.

---

🧾 Vulnerability Information

Property	Details
🆔 CVE	CVE-2026-58138
🚨 Severity	CRITICAL
📊 CVSS v3.1	9.8 / 10
📊 CVSS v4.0	9.3 / 10
🧩 CWE	CWE-94 — Code Injection
🌐 Attack Vector	Network
🔓 Privileges Required	None
👤 User Interaction	None
💥 Impact	High Confidentiality, Integrity & Availability Impact
🖥️ Affected Product	Conductor
🛠️ Fixed Version	3.30.2

---

🎯 Affected Versions

The following version range is reported as affected:

>= 3.21.21
<  3.30.2

Version Status

Version	Status
< 3.21.21	⚪ Not listed in affected range
3.21.21 – 3.30.1	🔴 Vulnerable
>= 3.30.2	🟢 Patched

---

🔍 Technical Summary

The vulnerability is associated with unsafe script evaluation through GraalVM polyglot contexts.

Affected workflow task functionality may include:

• INLINE
• LAMBDA
• DO_WHILE
• SWITCH

The security issue arises when attacker-controlled expressions are evaluated with excessive access to the underlying host environment.

Potentially dangerous evaluator configurations include excessive host access, allowing user-supplied scripts to interact with Java host objects and system-level functionality.

High-Level Attack Surface

┌─────────────────────┐
│ Remote Attacker     │
└──────────┬──────────┘
           │
           │ Crafted Workflow Definition
           ▼
┌─────────────────────┐
│ Conductor API       │
│ Authentication Gap  │
└──────────┬──────────┘
           │
           ▼
┌─────────────────────┐
│ Workflow Engine     │
│ Script Evaluation   │
└──────────┬──────────┘
           │
           ▼
┌─────────────────────┐
│ GraalVM Evaluator   │
│ Unsafe Host Access  │
└──────────┬──────────┘
           │
           ▼
      ⚠️ SECURITY RISK

---

💥 Potential Impact

Successful exploitation could potentially allow an attacker to:

• 🚨 Execute commands under the Conductor process context
• 🔐 Access sensitive application data
• 🗄️ Access connected infrastructure services
• 🔑 Retrieve exposed credentials or secrets
• 🔄 Modify workflow definitions
• 🌐 Pivot to connected systems
• 💣 Compromise workflow orchestration infrastructure

The actual impact depends heavily on the privileges assigned to the Conductor process.

Security Best Practice: Never run workflow orchestration services with unnecessary administrative or root privileges.

---

🛡️ Mitigation

1️⃣ Upgrade Immediately

Upgrade Conductor to:

3.30.2 or later

---

2️⃣ Restrict API Access

Do not expose Conductor management APIs directly to the public internet.

Recommended architecture:

Internet
    │
    ▼
┌───────────────┐
│ WAF / Gateway │
└───────┬───────┘
        │
        ▼
┌────────────────┐
│ Authentication │
│ Authorization  │
└───────┬────────┘
        │
        ▼
┌────────────────┐
│ Conductor API  │
└────────────────┘

---

3️⃣ Apply Least Privilege

Run Conductor with a restricted service account.

Avoid:

❌ root
❌ Administrator
❌ Privileged infrastructure accounts

Prefer:

✅ Dedicated service account
✅ Minimal filesystem permissions
✅ Restricted network access

---

4️⃣ Monitor Workflow Definitions

Review workflow definitions containing potentially dangerous script expressions.

Security monitoring should investigate unexpected references to:

Runtime
ProcessBuilder
java.lang
reflection
subprocess
shell execution

Detection should focus on suspicious behavior rather than relying solely on string matching.

---

🔎 Defensive Detection

Security teams should monitor for:

• Unexpected workflow registrations
• Unauthenticated API activity
• Suspicious INLINE task definitions
• Abnormal Java process behavior
• Unexpected child processes spawned by Conductor
• Shell interpreter execution
• Unexpected outbound network connections
• Privilege escalation attempts

Example Monitoring Flow

Conductor Logs
      │
      ▼
Workflow Registration Events
      │
      ▼
Expression Inspection
      │
      ▼
Suspicious Behavior Detection
      │
      ▼
🚨 SOC Alert

---

🧪 Safe Version Verification

This repository should only contain non-destructive detection logic.

A safe checker can:

[✓] Detect installed version
[✓] Compare version against affected range
[✓] Identify exposed service metadata
[✓] Report patch status
[✓] Generate remediation guidance

It should NOT: