PT-2026-53941 · Orkes · Orkes Conductor

Seqradev · Published 2026-06-30 · Updated 2026-06-30 · CVE-2026-58138

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Orkes Conductor versions 3.21.21 through 3.30.1

Description An unauthenticated remote code execution issue exists that allows remote attackers to execute arbitrary OS commands. This occurs when malicious JavaScript or Python expressions are submitted to the workflow API endpoint before authentication. Attackers can leverage unsandboxed GraalVM evaluators—which are configured with HostAccess.ALL or allowAllAccess(true)—through INLINE, LAMBDA, DO WHILE, and SWITCH task types to invoke system commands via Java reflection or direct subprocess calls.

Recommendations Update Orkes Conductor to version 3.30.2 or later.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-58138

Affected Products

Orkes Conductor

References · 7

• https://github.com/conductor-oss/conductor/commit/87a7d96aabbb706d6e84f812b93da5165028d18f · Patch
• https://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-58138 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-26074 · Security Note
• https://github.com/conductor-oss/conductor/releases/tag/v3.30.2 · Note
• https://vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators · Note
• https://twitter.com/seqradev/status/2072083547440005422 · Twitter Post