CVE Intelligence
Analysis AI-assisted

CVE-2026-58138: Orkes Conductor unauthenticated code injection leading to RCE via GraalVM evaluators

CVE-2026-58138 describes an unauthenticated remote code execution flaw in Orkes Conductor, classified as code injection (CWE-94). According to the record, versions from 3.21.21 before 3.30.2 are affected when inline workflow definitions reach unsandboxed GraalVM evaluators before authentication. The CVSS 3.1 base score is 9.8 (Critical), and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

The record describes an unauthenticated remote code execution flaw in Orkes Conductor, classified as code injection (CWE-94). According to the description, inline workflow definitions submitted to the workflow API before authentication can carry JavaScript or Python expressions that are evaluated by GraalVM script evaluators without a sandbox.

Impact

  • According to the description, a remote attacker could run arbitrary operating system commands on the affected server.
  • The CVSS 3.1 base score is 9.8 (Critical), with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates network access, low complexity, no privileges and no user interaction.
  • The CNA also lists a CVSS 4.0 base score of 9.3.

Affected products and versions

  • The description states that Orkes Conductor 3.21.21 before 3.30.2 is affected.
  • The structured affected-product list in the record is empty, so the exact range should be confirmed against the vendor advisory and release notes.
  • The record references a release and commits in the conductor-oss repository, which are useful starting points for version verification.

Exploitation status

  • The record shows that this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation appears in the sources consulted for this analysis.
  • The EPSS probability is 0.14687 with a percentile of 0.96607, dated 2026-10-13. This is a statistical estimate and is not evidence of exploitation.

Remediation and mitigation

  • Upgrade Orkes Conductor to version 3.30.2 or later, since the description sets 3.30.2 as the upper boundary of the affected range. Confirm this with the referenced release page.
  • Restrict access to the workflow API so that it is not reachable from untrusted networks until the patch is applied.
  • Review any GraalVM evaluator configuration that grants broad host access, and follow the vendor guidance for changing it.
  • Read the VulnCheck advisory for the vendor-independent description of the issue.

Detection guidance

  • Log and review workflow definition submissions received without authentication, especially those using INLINE, LAMBDA, DO_WHILE or SWITCH task types.
  • Alert on unexpected child processes started by the Conductor service process.
  • Watch for outbound connections or unexpected file changes originating from the Conductor runtime.

Limitations of the available information

  • The record has no structured affected or fixed version data, so version boundaries rely on the description text.
  • The record does not include the full vendor advisory text, so technical details beyond the description are unknown.
  • One reference in the record points to a different CVE identifier (CVE-2025-26074), and its relationship to this entry is not explained.
  • The CNA status is listed as Deferred, so the details may change.

Frequently asked questions

Does CVE-2026-58138 require authentication to exploit?

According to the description, the workflow submission happens before authentication, so the record indicates no prior authentication is needed. The CVSS 3.1 vector also lists no privileges required.

Is this vulnerability known to be exploited in the wild?

The record shows that the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.