🚨 CVE-2026-58138 — Unauthenticated Remote Code Execution

🔥 Critical Unauthenticated Remote Code Execution in Conductor

Affected versions: 3.21.21 → < 3.30.2

📌 Overview

CVE-2026-58138 is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting Conductor / Orkes Conductor.

The vulnerability exists in the application's handling of user-controlled script expressions evaluated through GraalVM. Unsafe evaluator configurations can expose host functionality to attacker-controlled expressions.

Under vulnerable configurations, an unauthenticated remote attacker may be able to submit a crafted workflow definition containing malicious expressions and potentially execute commands in the security context of the Conductor process.

⚠️ Severity: CRITICAL — Immediate patching is strongly recommended.

🧾 Vulnerability Information

🎯 Affected Versions

The following version range is reported as affected:

>= 3.21.21
<  3.30.2

Version Status

🔍 Technical Summary

The vulnerability is associated with unsafe script evaluation through GraalVM polyglot contexts.

Affected workflow task functionality may include:

• INLINE
• LAMBDA
• DO_WHILE
• SWITCH

The security issue arises when attacker-controlled expressions are evaluated with excessive access to the underlying host environment.

Potentially dangerous evaluator configurations include excessive host access, allowing user-supplied scripts to interact with Java host objects and system-level functionality.

High-Level Attack Surface

┌─────────────────────┐
│ Remote Attacker     │
└──────────┬──────────┘
           │
           │ Crafted Workflow Definition
           ▼
┌─────────────────────┐
│ Conductor API       │
│ Authentication Gap  │
└──────────┬──────────┘
           │
           ▼
┌─────────────────────┐
│ Workflow Engine     │
│ Script Evaluation   │
└──────────┬──────────┘
           │
           ▼
┌─────────────────────┐
│ GraalVM Evaluator   │
│ Unsafe Host Access  │
└──────────┬──────────┘
           │
           ▼
      ⚠️ SECURITY RISK

💥 Potential Impact

Successful exploitation could potentially allow an attacker to:

• 🚨 Execute commands under the Conductor process context
• 🔐 Access sensitive application data
• 🗄️ Access connected infrastructure services
• 🔑 Retrieve exposed credentials or secrets
• 🔄 Modify workflow definitions
• 🌐 Pivot to connected systems
• 💣 Compromise workflow orchestration infrastructure

The actual impact depends heavily on the privileges assigned to the Conductor process.

Security Best Practice: Never run workflow orchestration services with unnecessary administrative or root privileges.

🛡️ Mitigation

1️⃣ Upgrade Immediately

Upgrade Conductor to:

3.30.2 or later

2️⃣ Restrict API Access

Do not expose Conductor management APIs directly to the public internet.

Recommended architecture:

Internet
    │
    ▼
┌───────────────┐
│ WAF / Gateway │
└───────┬───────┘
        │
        ▼
┌────────────────┐
│ Authentication │
│ Authorization  │
└───────┬────────┘
        │
        ▼
┌────────────────┐
│ Conductor API  │
└────────────────┘

3️⃣ Apply Least Privilege

Run Conductor with a restricted service account.

Avoid:

❌ root
❌ Administrator
❌ Privileged infrastructure accounts

Prefer:

✅ Dedicated service account
✅ Minimal filesystem permissions
✅ Restricted network access

4️⃣ Monitor Workflow Definitions

Review workflow definitions containing potentially dangerous script expressions.

Security monitoring should investigate unexpected references to:

Runtime
ProcessBuilder
java.lang
reflection
subprocess
shell execution

Detection should focus on suspicious behavior rather than relying solely on string matching.

🔎 Defensive Detection

Security teams should monitor for:

• Unexpected workflow registrations
• Unauthenticated API activity
• Suspicious INLINE task definitions
• Abnormal Java process behavior
• Unexpected child processes spawned by Conductor
• Shell interpreter execution
• Unexpected outbound network connections
• Privilege escalation attempts

Example Monitoring Flow

Conductor Logs
      │
      ▼
Workflow Registration Events
      │
      ▼
Expression Inspection
      │
      ▼
Suspicious Behavior Detection
      │
      ▼
🚨 SOC Alert

🧪 Safe Version Verification

This repository should only contain non-destructive detection logic.

A safe checker can:

[✓] Detect installed version
[✓] Compare version against affected range
[✓] Identify exposed service metadata
[✓] Report patch status
[✓] Generate remediation guidance

It should NOT:

[✗] Execute commands
[✗] Submit malicious workflows
[✗] Attempt RCE
[✗] Modify server configuration
[✗] Create persistence

📊 Risk Assessment

Overall Risk

🔥 CRITICAL

🛠️ Recommended Security Checklist

• Upgrade to 3.30.2 or later
• Restrict access to Conductor APIs
• Require authentication
• Implement network segmentation
• Review workflow definitions
• Monitor process execution
• Run services with least privilege
• Audit stored credentials
• Review historical API logs
• Implement security alerting

📚 References

• GitHub Security Advisory
• NVD — CVE-2026-58138
• Conductor Repository
• Conductor v3.30.2 Release

⚠️ Disclaimer

This repository is intended for educational, defensive,
and authorized security research purposes only.

Do not attempt to exploit systems that you do not own
or do not have explicit permission to test.

The maintainers assume no responsibility for misuse.

🏷️ Tags

CVE-2026-58138
Cybersecurity
Vulnerability Research
Remote Code Execution
RCE
Conductor
Orkes
GraalVM
CWE-94
Code Injection
Security Research
Blue Team
Defensive Security