Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution

Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...

CVE-2026-58138

CVE-2026-58138 — Conductor 3.21.21..3.30.2 인증되지 않은 원격 코드 실행 Orkes Conductor의 심각한 원격 코드 실행 취약점 📋 개요 CVE-2026-58138 는 Orkes Conductor 버전 3.21.21부터 3.30.1까지 영향을 미치는 심각한 인증되지 않은 원격 코드 실행RCE 취약점입니다. 이 취약점으로 인해 공격자는 인증 없이 Conductor 서버에서 임의의 명령을 실행할 수 있으며, 잠재적으로 전체 시스템을 손상시킬 수 있습니다. 🔴 심각도...

cve-2026-58138

CVE-2026-58138: Conductor 인증되지 않은 RCE CVE-2026-58138Conductor의 CVSS 9.8 코드 삽입 취약점용 재현 키트입니다. Conductor에서 발생하며, OpenTaint 규칙, GraalVM 근사치, 격리된 규칙 테스트, 스캔 결과, 그리고 실제 동작하는 익스플로잇이 포함되어 있습니다. 케이스 스터디 읽기 대화형 HTML 보고서 열기 포함된 SARIF 보기 OpenTaint 받기 스캔은 Conductor v3.23.0을 대상으로 하며, 인증되지 않은 워크플로 입력에서 전체 호스트...

CVE-2026-58138

CVE-2026-58138 — GraalVM Evaluator を介した Conductor の未認証 RCE -critical 要約: Orkes/OSS Conductor（バージョン 3.21.21 から 3.30.2）は、INLINE タスクでユーザーが指定した JavaScript を、完全なホストアクセス （HostAccess.ALL）を許可した GraalVM コンテキストで評価します。コミュニティ API はデフォルトで認証がないため、未認証のユーザーが悪意のあるワークフローを送信し、バインドされた JavaScript オブジェクトから...

CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — GraalVM INLINE 평가기를 통한 Conductor 인증되지 않은 RCE Conductor OSS / Orkes3.21.21 … 3.30.2 미만은 사용자가 제공한 JavaScript를 INLINE 및 LAMBDA / DOWHILE / SWITCH 태스크에서 GraalVM 컨텍스트로 평가하며, 전체 호스트 접근 HostAccess.ALL이 활성화되어 있습니다. 스크립트는 java.lang.Runtime까지 리플렉션하여 OS 명령을 실행합니다. 커뮤니티 API에는 기본적으로 인증이 없으므로 ...

vault-conductor

🗝️ vault-conductor Bitwarden Secret Manager에 시크릿으로 저장된 SSH 키를 제공하는 SSH 에이전트입니다. SSH 인증 및 Git 커밋 서명을 지원합니다. 데모 기능 SSH 클라이언트와 Bitwarden Secrets Manager 사이의 안전한 브리지 역할을 하는 Unix 도메인 소켓 서버로 SSH 에이전트 프로토콜을 구현합니다...

OrkesConductor 3.30.2 Remote Code Execution

OrkesConductor version 3.30.2 suffers from a remote code execution vulnerability. !/usr/bin/env python3 Exploit Title: OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution CVE: CVE-2026-58138 Date: 2026-07-10 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram:...

VulnCheck KEV: CVE-2026-58138

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

CVE-2026-58138

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

CVE-2026-58138

Orkes Conductor CVE-2026-58138 affects versions 3.21.21–3.30.1, where an INLINE task evaluating JavaScript in GraalVM with HostAccess.ALL allows unauthenticated remote code execution by reflecting to java.lang.Runtime and executing OS commands via the workflow API. Public templates and exploits c...

EUVD-2026-40377

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

CVE-2026-58138 Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

CVE-2026-58138

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

CVE-2026-58138 Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

PT-2026-53941

Name of the Vulnerable Software and Affected Versions Orkes Conductor versions 3.21.21 through 3.30.1 Description An unauthenticated remote code execution issue allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or...

CVE-2026-44917

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxetemplate...

PT-2026-46138

Name of the Vulnerable Software and Affected Versions OpenStack Ironic versions prior to 35.0.2 Description An authenticated project admin or manager can read local files on the Ironic conductor by exploiting the pxe template variable. Recommendations Update to version 35.0.2 or later...

CVE-2026-44917

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxetemplate...

EUVD-2026-34202

OpenStack Ironic before 35.0.2 allows a malicious authenticated project admin or manager to read local files on the Ironic conductor via a pxetemplate...

CVE-2026-44917

OpenStack Ironic (prior to 35.0.2) is vulnerable to an information-disclosure issue where a malicious authenticated project admin or manager can read local files on the Ironic conductor via a pxe_template. This CVE is documented across multiple sources (OpenStack Ironic, Debian tracker, CVE lists...