237 matches found
Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution
Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...
CVE-2026-58138
CVE-2026-58138 — Conductor 3.21.21..3.30.2 Nicht authentifizierte Remote-Codeausführung Kritische Remote-Codeausführung-Schwachstelle in Orkes Conductor 📋 Übersicht CVE-2026-58138 ist eine kritische, nicht authentifizierte Remote-Codeausführung RCE Schwachstelle, die Orkes Conductor Versionen...
cve-2026-58138
CVE-2026-58138: Conductor RCE non autenticato Kit di riproduzione per CVE-2026-58138, una vulnerabilità di iniezione di codice con CVSS 9.8 in Conductor. Contiene la regola OpenTaint e le approssimazioni GraalVM, test isolati della regola, il risultato della scansione e un exploit funzionante...
vault-conductor
🗝️ vault-conductor Ein SSH-Agent, der in Bitwarden Secret Manager als Secrets gespeicherte SSH-Schlüssel bereitstellt. Unterstützt SSH-Authentifizierung und das Signieren von Git-Commits. Demo Funktionen...
CVE-2026-58138
CVE-2026-58138 – Nicht authentifizierte RCE in Conductor über GraalVM Evaluator -critical TL;DR: Orkes/OSS Conductor Versionen 3.21.21 bis 3.30.2 wertet in INLINE-Tasks vom Benutzer bereitgestelltes JavaScript mit einem GraalVM-Kontext aus, der vollen Host-Zugriff HostAccess.ALL besitzt. Da die...
CVE-2026-58138-Conductor-Unauth-RCE
CVE-2026-58138 — Conductor Unauthentifizierte RCE über INLINE GraalVM Evaluator Conductor OSS / Orkes3.21.21 … vor 3.30.2 wertet benutzerbereitgestelltes JavaScript in INLINE und LAMBDA / DOWHILE / SWITCH Aufgaben mit einem GraalVM-Kontext aus, der mit vollem Host-Zugriff HostAccess.ALL erstellt...
OrkesConductor 3.30.2 Remote Code Execution
OrkesConductor version 3.30.2 suffers from a remote code execution vulnerability. !/usr/bin/env python3 Exploit Title: OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution CVE: CVE-2026-58138 Date: 2026-07-10 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram:...
VulnCheck KEV: CVE-2026-58138
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...
CVE-2026-58138
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...
CVE-2026-58138
Orkes Conductor CVE-2026-58138 affects versions 3.21.21–3.30.1, where an INLINE task evaluating JavaScript in GraalVM with HostAccess.ALL allows unauthenticated remote code execution by reflecting to java.lang.Runtime and executing OS commands via the workflow API. Public templates and exploits c...
EUVD-2026-40377
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...
CVE-2026-58138 Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...
CVE-2026-58138
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...
CVE-2026-58138 Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...
PT-2026-53941
Name of the Vulnerable Software and Affected Versions Orkes Conductor versions 3.21.21 through 3.30.1 Description An unauthenticated remote code execution issue allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or...
CVE-2026-44917
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxetemplate...
PT-2026-46138
Name of the Vulnerable Software and Affected Versions OpenStack Ironic versions prior to 35.0.2 Description An authenticated project admin or manager can read local files on the Ironic conductor by exploiting the pxe template variable. Recommendations Update to version 35.0.2 or later...
CVE-2026-44917
OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxetemplate...
CVE-2026-44917
OpenStack Ironic (prior to 35.0.2) is vulnerable to an information-disclosure issue where a malicious authenticated project admin or manager can read local files on the Ironic conductor via a pxe_template. This CVE is documented across multiple sources (OpenStack Ironic, Debian tracker, CVE lists...