---
id: CVE-2026-58138
title: >-
  Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script
  Evaluators
summary: >-
  Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code
  execution vulnerability that allows remote attackers to execute arbitrary OS
  commands by submitting inline workflow definitions containing malicious
  JavaScript…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-94
vendor: conductor-oss
product: conductor
affected:
  - conductor >= 3.21.21 < 3.30.2
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-07-01T15:02:06.515465Z'
exploitAvailable: true
published: '2026-06-30'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:45.906Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-58138'
references:
  - url: 'https://github.com/conductor-oss/conductor/releases/tag/v3.30.2'
    label: conductor 3.30.2 Release Notes
  - url: >-
      https://github.com/conductor-oss/conductor/commit/87a7d96aabbb706d6e84f812b93da5165028d18f
    label: Patch Commit (1)
  - url: >-
      https://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1
    label: Patch Commit (2)
  - url: 'https://www.cve.org/CVERecord?id=CVE-2025-26074'
    label: Related CVE
  - url: >-
      https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators
tags:
  - cve.org
  - exploit-available
epss: 0.09143
epssPercentile: 0.9535
exploits:
  exploitdb: true
  github: 7
  githubRepos:
    - 'https://github.com/ashrafzaryouh/CVE-2026-58138'
    - 'https://github.com/Ch4120N/CVE-2026-58138'
    - 'https://github.com/BiiTts/CVE-2026-58138-Conductor-Unauth-RCE'
  nuclei:
    - CVE-2026-58138
  checkedAt: '2026-11-08T14:51:57.334Z'
ingestedAt: '2026-11-08T14:51:22.310Z'
---

## Overview

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.

## Affected

- `conductor >= 3.21.21 < 3.30.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.