CVE-2026-58138: Conductor unauthenticated RCE

Reproduction kit for CVE-2026-58138, a CVSS 9.8 code-injection vulnerability in Conductor. It contains the OpenTaint rule and GraalVM approximations, isolated rule tests, the scan result, and a working exploit.

• Read the case study
• Open the interactive HTML report
• View the included SARIF
• Get OpenTaint

The scan targets Conductor v3.23.0 and reports two findings from unauthenticated workflow input to full-host-access GraalVM evaluators. Each finding contains four HTTP entry-point flows:

• core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java:203
• core/src/main/java/com/netflix/conductor/core/execution/evaluators/PythonEvaluator.java:63

Contents

• .opentaint/rules/ - the join rule and full-host-access Context.eval sink
• .opentaint/model/config/ - passthrough models for GraalVM fluent builders
• .opentaint/test-projects/ - 15 positive and negative rule samples
• results/report.sarif - the reproduced OpenTaint findings
• poc/poc_inline_lambda_rce.py - the live exploit

Quick rule test

Requires OpenTaint and JDK 21.

opentaint compile \
  .opentaint/test-projects/graaljs-polyglot-code-injection \
  --output /tmp/conductor-rule-model

opentaint test rule run /tmp/conductor-rule-model \
  --ruleset .opentaint/rules \
  --passthrough-approximations .opentaint/model/config

Expected result: Passed: 15, failed: 0.

Reproduce the scan

git clone --depth 1 --branch v3.23.0 \
  https://github.com/conductor-oss/conductor.git conductor

opentaint scan ./conductor \
  --ruleset builtin \
  --ruleset .opentaint/rules \
  --rule-id java/security/graaljs-polyglot-code-injection.yaml:graaljs-polyglot-code-injection \
  --passthrough-approximations .opentaint/model/config \
  --max-memory 16G \
  --output results/report.sarif

opentaint summary results/report.sarif --show-findings

Expected result: two java/security/graaljs-polyglot-code-injection findings at the sinks listed above. Use the full <rule-file>:<rule-id> value shown in the command so OpenTaint also loads the source and sink rules referenced by the join.

Reproduce the exploit

Start Conductor v3.23.0 with its default server configuration, then run:

# JavaScript INLINE task
python3 poc/poc_inline_lambda_rce.py --base-url http://localhost:8000

# Other supported paths
python3 poc/poc_inline_lambda_rce.py --task-type lambda --variant js
python3 poc/poc_inline_lambda_rce.py --task-type inline --variant python

The script exits with status 0 after it confirms command execution. The PoC also supports DO_WHILE and SWITCH. Run it with --help for all options.

Conductor fixed the vulnerability in 3.30.2. See the case study for the vulnerable path, exploit details, rule design, and patch analysis.