CVE-2026-58138

Name of the Vulnerable Software and Affected Versions Orkes Conductor versions 3.21.21 through 3.30.1

Description An unauthenticated remote code execution issue exists that allows remote attackers to execute arbitrary OS commands. This is achieved by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint before authentication. The issue targets unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO WHILE, and SWITCH task types, enabling the invocation of system commands via Java reflection or direct subprocess calls. This flaw has been actively exploited in the wild, with reports of thousands of blocked attempts. In some configurations, the process may run with root privileges.

Recommendations Upgrade to version 3.30.2 or later. Place the workflow API behind an authentication mechanism permanently. Restrict network access to the workflow API and admin interfaces to trusted IP addresses only. Monitor for unexpected process creation or outbound connections from the server.