CVE-2026-58138 -- CVSS 9.8 Vulnerability Briefing

CVE-2026-58138 | CVSS 9.8 (Critical) | Exploit: PoC available

What Is It

CVE-2026-58138 is a critical unauthenticated remote code execution vulnerability in Orkes Conductor versions 3.21.21 through versions before 3.30.2, exposed through the workflow API endpoint.

Technical Detail

The flaw arises from unsandboxed GraalVM JavaScript and Python evaluators configured with HostAccess.ALL or allowAllAccess(true). A remote attacker can submit an inline workflow definition containing malicious expressions in INLINE, LAMBDA, DO_WHILE, or SWITCH task types before authentication is enforced. Successful exploitation allows arbitrary OS command execution on the affected Conductor server, potentially with the privileges of the service account.

Exploitation Status

A proof of concept is available. CVE-2026-58138 is not listed in CISA's Known Exploited Vulnerabilities catalog as of August 14, 2026, and active exploitation in the wild has not been confirmed.

Who Is Targeting This

No specific threat actor attribution at this time.

What To Do

Upgrade Orkes Conductor to version 3.30.2 or later as a priority, particularly for instances whose workflow API is reachable from untrusted networks. Until patching is complete, restrict access to workflow API endpoints using network controls and authentication gateways, and disable or limit inline workflow evaluation and affected task types where operationally feasible. Review Conductor workflow submissions, application logs, and host telemetry for unexpected inline JavaScript or Python expressions, suspicious workflow executions, child process creation, and outbound connections originating from the Conductor service account. No vendor-provided detection signatures or additional workarounds are confirmed in the available data.