Vulnerability · Published Jun 30, 2026 · Assigned by VulnCheck

CVE-2026-58138Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

Critical 9.8

In plain English

A critical-severity code injection in conductor from conductor-oss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 9.1% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)9.1%top 4.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Nuclei, Public PoC

Official description

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.

Affected products (as reported)

Vendor	Product	Versions
conductor-oss	conductor	3.21.21 – before 3.30.2

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes
Patch Commit (1) patch
Patch Commit (2) patch
Related CVE
https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators third-party-advisory