CVE-2026-58138
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk56th percentile — higher than 56% of all known CVEs
Summary
Orkes Conductor versions 3.21.21 through 3.30.2 contain an unauthenticated remote code execution vulnerability. Attackers can submit malicious workflow definitions with JavaScript or Python expressions to the API before authentication, allowing arbitrary OS command execution.
Risk Assessment
The risk is critical as unauthenticated attackers can gain full server control, execute arbitrary commands, install malware, or exfiltrate data.
Recommendation
Immediately upgrade Orkes Conductor to version 3.30.2 or later. Restrict access to the workflow API and configure GraalVM with secure settings (without HostAccess.ALL and allowAllAccess(true)).
Original NVD description (English source)
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.