CVE-2026-58138
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
Early warning: exploitation observed
- Exploitation observed since Jul 27, 2026
- Not yet in the official CISA catalogue
- First attack observed 26 days after disclosure
- Confirmed by sensors, not only by reports
Source: VulnCheck KEV · Nov 4, 2026 Nov 3, 2026 Nov 2, 2026 Nov 1, 2026 Oct 31, 2026 Oct 30, 2026
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HRelated articles
Exploited Cisco ISE Flaw Leads a Wave of Attacks on Trusted Software Channels
Active exploitation of a critical Cisco ISE flaw highlights attacks through trusted software channels, Orkes, Discourse, libheif and AI plugins.
Exposed Orkes Conductor APIs Turn Workflow Scripts Into Root-Level Attack Paths
Unauthenticated CVE-2026-58138 in Orkes Conductor allows RCE via malicious workflows. Learn affected versions, active exploitation, and how to patch.
This product uses the NVD API but is not endorsed or certified by the NVD.