CVE-2025-26074: Orkes Conductor RCE Vulnerability

CVE-2025-26074 Overview

CVE-2025-26074 is a critical Remote Code Execution (RCE) vulnerability affecting Orkes Conductor v3.21.11. This vulnerability allows remote attackers to execute arbitrary operating system commands through unrestricted access to Java classes. The flaw resides in the inline JavaScript evaluation mechanism, where insufficient restrictions on accessible Java classes enable attackers to leverage the Nashorn JavaScript engine to invoke dangerous system-level operations.

Critical Impact
Remote attackers can execute arbitrary OS commands on the underlying server without authentication, potentially leading to complete system compromise, data exfiltration, and lateral movement within the network.

Affected Products

Orkes Conductor v3.21.11
Conductor OSS (Open Source) implementations using vulnerable ScriptEvaluator

Discovery Timeline

2025-06-30 - CVE-2025-26074 published to NVD
2025-06-30 - Last updated in NVD database

Technical Details for CVE-2025-26074

Vulnerability Analysis

This vulnerability is classified as CWE-78 (Improper Neutralization of Special Elements used in an OS Command) and represents a severe security flaw in the Conductor workflow orchestration platform. The vulnerability exists within the ScriptEvaluator.java component, which processes inline JavaScript expressions as part of workflow definitions.

The Conductor platform uses the Nashorn JavaScript engine to evaluate dynamic expressions within workflows. However, the implementation fails to adequately restrict access to Java classes from within the JavaScript execution context. This architectural weakness allows attackers to invoke arbitrary Java classes, including those capable of spawning system processes.

When exploited, an attacker can craft malicious workflow definitions or event handlers containing JavaScript that breaks out of the intended scripting sandbox. By accessing Java's Runtime class or ProcessBuilder, the attacker can execute arbitrary operating system commands with the privileges of the Conductor service account.

Root Cause

The root cause of CVE-2025-26074 lies in the ScriptEvaluator class's insufficient sandboxing of the JavaScript execution environment. The Nashorn engine, by default, allows JavaScript code to access Java classes through the Java.type() function. Without explicit restrictions or a security manager configured to prevent dangerous class access, attackers can instantiate and invoke methods on sensitive Java classes such as java.lang.Runtime and java.lang.ProcessBuilder.

The vulnerable code path permits workflow inputs and event handler scripts to contain arbitrary JavaScript that is then executed server-side without adequate validation or class access restrictions.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by submitting a malicious workflow definition or event handler configuration to the Conductor API. The JavaScript payload embedded within these definitions is processed by the ScriptEvaluator, which executes the code in an unrestricted context.

The exploitation technique involves using Nashorn's Java interoperability features to obtain a reference to java.lang.Runtime.getRuntime(), then invoking exec() with attacker-controlled command strings. This allows the attacker to execute any command available to the service account running Conductor, potentially including package installation, reverse shells, data exfiltration scripts, or destructive operations.

For detailed technical analysis of the injection technique, see the Medium Blog on CVE-2025-26074 and the GitHub ScriptEvaluator Source Code.

Detection Methods for CVE-2025-26074

Indicators of Compromise

Unusual workflow definitions containing JavaScript code with Java.type() calls
API requests creating or updating workflows with references to java.lang.Runtime or ProcessBuilder
Unexpected child processes spawned by the Conductor Java process
Network connections from the Conductor server to unusual external destinations

Detection Strategies

Monitor Conductor API endpoints for workflow submissions containing suspicious JavaScript patterns such as Java.type, Runtime, or ProcessBuilder
Implement application-level logging to capture all script evaluation requests and their contents
Deploy network detection rules to identify command-and-control traffic originating from Conductor servers
Use endpoint detection and response (EDR) solutions to monitor for anomalous process creation chains

Monitoring Recommendations

Enable verbose logging on the Conductor service and forward logs to a SIEM for analysis
Create alerts for any process execution by the Conductor service that does not match expected workflow behavior
Monitor for file system modifications in sensitive directories initiated by the Conductor process
Track outbound network connections from Conductor servers to identify potential data exfiltration

How to Mitigate CVE-2025-26074

Immediate Actions Required

Audit all existing workflow definitions for suspicious JavaScript containing Java class references
Implement network segmentation to limit the blast radius of a potential compromise
Restrict API access to the Conductor service using authentication and IP allowlisting
Consider temporarily disabling inline JavaScript evaluation if operationally feasible

Patch Information

Organizations should monitor the GitHub Conductor Repository for security updates and patches addressing this vulnerability. Until an official patch is released, implementing the workarounds below is strongly recommended to reduce exposure.

Workarounds

Deploy a Web Application Firewall (WAF) rule to block requests containing Java.type, Runtime.getRuntime, or ProcessBuilder in workflow definitions
Implement input validation at the API gateway level to reject workflow submissions with suspicious JavaScript patterns
Run the Conductor service with minimal operating system privileges to limit the impact of command execution
Consider deploying Conductor in a containerized environment with restricted capabilities and read-only file systems

bash

# Example: Running Conductor with restricted capabilities in Docker
docker run -d \
  --name conductor \
  --read-only \
  --cap-drop ALL \
  --security-opt no-new-privileges:true \
  --network conductor-isolated \
  conductor:v3.21.11