Table of Contents

1. Vulnerability Overview
2. The Root Cause
3. Exploitation Flow
4. Quick Start & Reproduction
5. Impact
6. Remediation
7. Detection
8. Credits & Disclaimer

Vulnerability Overview

Version Note: Versions up to ~3.29.x use the plain allowHostAccess(HostAccess.ALL) configuration, which this PoC directly exploits. Versions 3.30.0 and 3.30.1 introduced a partial blocklist (blocking some reflection), but the complete fix (allowHostClassLoading(false) + engine hardening) was only implemented in 3.30.2. This PoC targets the unsandboxed configuration.

The Root Cause

The vulnerability exists in how Conductor configures the GraalVM polyglot context for script evaluation.

In core/.../events/ScriptEvaluator.java (≤ 3.29.x), the context is built like this:

Why this is a game over:

1. HostAccess.ALL grants the JavaScript engine permission to call any method or access any field on Java host objects.
2. The INLINE task binds its input parameters to the JavaScript variable $, which is a real Java object.
3. An attacker can chain Java reflection starting from $: $.getClass().getClass() ➔ java.lang.Class ➔ Class.forName("java.lang.Runtime") ➔ Runtime.getRuntime().exec("sh -c <command>").
4. The same flaw exists in the Python evaluator (Context.newBuilder("python").allowAllAccess(true)).

Exploitation Flow

The attack requires zero authentication and follows three simple steps:

1. Register: Send a POST request to /api/metadata/workflow with a malicious workflow definition. The INLINE task contains the reflective JavaScript payload in its expression field.
2. Execute: Send a POST request to /api/workflow/{workflow_name} to trigger the workflow.
3. Extract: The GraalVM engine executes the payload. The reflective Runtime.exec runs the OS command, and the PoC cleverly captures the stdout and returns it as the task's result output, which is then fetched via the API.

Quick Start & Reproduction

1. Spin up the Vulnerable Lab

Start a local instance of the vulnerable Conductor version using Docker.

2. Execute the PoC

Run the provided Python exploit script. It relies only on the Python standard library (no external dependencies required).

3. Expected Output

Note: The uid=0(root) output proves genuine execution on the host, not a mocked response.

Impact

Successful exploitation grants the attacker arbitrary OS command execution on the Conductor orchestrator host.

Because Conductor is often deployed with elevated privileges to manage infrastructure, this typically results in:

• Full compromise of the workflow engine.
• Access to underlying persistence layers (Redis, PostgreSQL, Elasticsearch).
• Lateral movement via stored credentials or downstream systems triggered by workflows.

Remediation

1. Upgrade Immediately: Update to Conductor ≥ 3.30.2. In this version, JS and Python evaluators no longer run with host access or class loading enabled.
2. Defense in Depth:
   • Place an authentication gateway (e.g., OAuth2, API Keys) in front of the Conductor API.
   • Run the Conductor server process as a non-root, least-privilege user.
   • Implement strict network segmentation to restrict who can register or execute workflows.

Detection

Monitor your environment for the following indicators of compromise (IoCs):

• Workflow Definitions: Flag any INLINE, LAMBDA, DO_WHILE, or SWITCH tasks containing expression strings that reference:
  • getClass, forName, Runtime, exec, ProcessBuilder
  • java.lang.reflect or generic java. package access
• Host-Level Alerts: Monitor for Conductor JVM processes unexpectedly spawning shell interpreters (sh, bash, cmd.exe) or making outbound network connections.

For a deep dive into the reflection chain, version-specific evaluator configurations, and patch analysis, refer to ANALYSIS.md.

Credits & Disclaimer

• Repository Maintenance: Ch4120N
• PoC Refinement: (Ch4120N/CVE-2026-58138)
• Advisory Reference: Orkes Conductor unauth RCE via GraalVM script evaluators

Disclaimer: This repository contains an independent, reproducible lab and Proof of Concept (PoC) intended strictly for defensive, educational, and authorized security testing purposes. Do not use this code against systems you do not own or have explicit written permission to test. The authors assume no liability for misuse.