CVE-2026-58138
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
| CWE | CWE-94 |
| Vendor | conductor-oss |
| Product | conductor |
| Published | Jun 30, 2026 |
Stay Ahead of the Next One
Get instant alerts for conductor-oss conductor
Be the first to know when new critical vulnerabilities affecting conductor-oss conductor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
conductor-oss / conductor
3.21.21 < 3.30.2
References
github.com: https://github.com/conductor-oss/conductor/releases/tag/v3.30.2 github.com: https://github.com/conductor-oss/conductor/commit/87a7d96aabbb706d6e84f812b93da5165028d18f github.com: https://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1 cve.org: https://www.cve.org/CVERecord?id=CVE-2025-26074 vulncheck.com: https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators
Credits
seqradev