Critical severity · published Jun 30, 2026
CVE-2026-58138
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
9.8
CVSS
9.1%
EPSS
No
On KEV
Description
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)9.1% · higher than 95% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
conductor · conductor-oss
3.21.21 before 3.30.2 · source: vendor
In the news
VulnerabilityCritical
Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild
A critical vulnerability impacting Orkes Conductor is being actively exploited in the wild, according to Fortinet.
The vulnerability in question is CVE-2026-58138 (CVSS v3.1 score: 9.8/CVSS v4 score: 9.3), which relates to a case of unauthenticated remote code execution.
"Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote
Sep 19, 2026·The Hacker News
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-58138
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-58138
github.com
https://github.com/conductor-oss/conductor/commit/87a7d96aabbb706d6e84f812b93da5165028d18f
github.com
https://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1
github.com
https://github.com/conductor-oss/conductor/releases/tag/v3.30.2
www.cve.org
https://www.cve.org/CVERecord?id=CVE-2025-26074
www.vulncheck.com
https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators
More from conductor
7.3
CVE-2026-109405
conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery
7.3
CVE-2026-109403
conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery
6.3
CVE-2026-109402
conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery
6.3
CVE-2026-109190
conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery
5.3
CVE-2026-109404
conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery