CVE-2026-58138: Orkes Conductor RCE Vulnerability

CVE-2026-58138 Overview

CVE-2026-58138 is an unauthenticated remote code execution vulnerability in Orkes Conductor versions 3.21.21 through versions prior to 3.30.2. Remote attackers can execute arbitrary operating system commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint. The flaw resides in unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true). Attackers abuse INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke system commands via Java reflection or direct subprocess calls. The vulnerability is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
Unauthenticated attackers can achieve arbitrary OS command execution on Conductor hosts by submitting workflow definitions to the pre-authentication API endpoint.

Affected Products

Orkes Conductor 3.21.21 through versions prior to 3.30.2
Deployments using JavaScript evaluators with HostAccess.ALL
Deployments using Python evaluators with allowAllAccess(true)

Discovery Timeline

2026-06-30 - CVE-2026-58138 published to NVD
2026-07-02 - Last updated in NVD database

Technical Details for CVE-2026-58138

Vulnerability Analysis

Orkes Conductor is a workflow orchestration platform originally derived from Netflix Conductor. The platform supports inline scripting through GraalVM polyglot contexts for JavaScript and Python expressions embedded in workflow definitions. Task types including INLINE, LAMBDA, DO_WHILE, and SWITCH invoke these evaluators to compute runtime values.

The workflow submission API endpoint accepts inline workflow definitions before authentication is enforced. Attackers submit crafted JSON payloads containing hostile JavaScript or Python expressions. The evaluators execute the expressions in a GraalVM Context that has full host access, granting expressions the ability to reach Java classes such as java.lang.Runtime, java.lang.ProcessBuilder, and java.lang.reflect.Method.

With reflection available, expressions instantiate arbitrary classes and invoke methods to spawn OS processes. The attack requires no credentials, no user interaction, and yields full code execution under the identity of the Conductor server process.

Root Cause

The JavaScript ScriptEvaluator constructed its GraalVM Context with .allowHostAccess(HostAccess.ALL), permitting unrestricted access to all Java host classes. The PythonEvaluator used .allowAllAccess(true), which enables host class lookup, native access, IO, and thread creation. Neither evaluator restricted dangerous classes such as Runtime, ProcessBuilder, or the java.lang.reflect package.

Attack Vector

Exploitation is remote and unauthenticated over the network. Attackers POST a workflow definition to the workflow API with an inline task containing a script that resolves java.lang.Runtime via reflection and invokes exec() with attacker-controlled arguments. Similar payloads work through Python evaluators by importing java and calling host methods directly.

java

// Patch from ScriptEvaluator.java restricting host access
private static Context createNewContext() {
    HostAccess hostAccess =
            HostAccess.newBuilder(HostAccess.ALL)
                    .denyAccess(Class.class)
                    .denyAccess(ClassLoader.class)
                    .denyAccess(java.lang.reflect.Method.class)
                    .denyAccess(java.lang.reflect.Field.class)
                    .denyAccess(java.lang.reflect.Constructor.class)
                    .denyAccess(java.lang.reflect.Array.class)
                    .denyAccess(Runtime.class)
                    .denyAccess(ProcessBuilder.class)
                    .denyAccess(Process.class)
                    .denyAccess(System.class)
                    .denyAccess(Thread.class)
                    .denyAccess(ThreadGroup.class)
                    .build();
    return Context.newBuilder("js")
            .allowHostAccess(hostAccess)
            .option("engine.WarnInterpreterOnly", "false")
            .build();
}

Source: conductor-oss/conductor commit 87a7d96

java

// Patch from PythonEvaluator.java removing allowAllAccess
@Override
public Object evaluate(String expression, Object input) {
    try (Context context = Context.newBuilder("python").build()) {
        if (input instanceof Map) {
            Map<String, Object> inputMap = (Map<String, Object>) input;

Source: conductor-oss/conductor commit 87a7d96

Detection Methods for CVE-2026-58138

Indicators of Compromise

Unauthenticated POST requests to Conductor workflow API endpoints containing INLINE, LAMBDA, DO_WHILE, or SWITCH task definitions with embedded script bodies
Script expressions referencing java.lang.Runtime, ProcessBuilder, Java.type, or .getClass().forName() in workflow payloads
Conductor server process spawning unexpected child processes such as sh, bash, curl, wget, or python
Outbound network connections from the Conductor JVM to external hosts not associated with orchestrated tasks

Detection Strategies

Inspect Conductor access logs for workflow submissions from unauthenticated sources and correlate with process creation telemetry on host systems
Alert on JVM process ancestry where the Conductor server is the parent of shell interpreters, package managers, or reconnaissance binaries
Deploy EDR behavioral analytics that flag reflection-based command execution originating from Java workloads

Monitoring Recommendations

Forward Conductor application logs, host process telemetry, and network flows to a centralized data lake for cross-source correlation
Baseline normal workflow task types and evaluator usage, then alert on deviations such as new inline scripts from unknown clients
Monitor for GraalVM context creation errors after patching to identify legitimate workflows relying on previously permitted classes

How to Mitigate CVE-2026-58138

Immediate Actions Required

Upgrade Orkes Conductor to version 3.30.2 or later, which restricts GraalVM host access in the ScriptEvaluator and PythonEvaluator
Block unauthenticated access to workflow API endpoints at the reverse proxy or ingress layer until patching is complete
Audit existing workflow definitions for inline scripts that reference reflection, Runtime, or ProcessBuilder and remove or rewrite them
Rotate credentials, tokens, and secrets accessible to the Conductor process if exploitation is suspected

Patch Information

The fix landed in Conductor version 3.30.2. Commit 87a7d96 replaces HostAccess.ALL with a builder that denies access to Class, ClassLoader, reflection classes, Runtime, ProcessBuilder, Process, System, Thread, and ThreadGroup, and removes allowAllAccess(true) from the Python evaluator. Follow-up commit c691e35 further restricts GraalJS by disabling IO access. See the Conductor v3.30.2 release notes and the VulnCheck advisory for full details.

Workarounds

Place Conductor behind an authenticating gateway that rejects workflow submissions from unauthenticated principals
Disable the INLINE, LAMBDA, DO_WHILE, and SWITCH task types until an upgrade to 3.30.2 is complete
Run the Conductor JVM under a hardened service account with no shell access and apply seccomp or AppArmor profiles to block execve on unexpected binaries
Segment the Conductor host from sensitive internal networks to contain post-exploitation movement

bash

# Verify the running Conductor version and upgrade
curl -s http://conductor-host:8080/api/admin/config | jq '.version'

# Pull and deploy the patched release
docker pull conductoross/conductor:3.30.2
docker stop conductor && docker rm conductor
docker run -d --name conductor -p 8080:8080 conductoross/conductor:3.30.2