CVE-2026-58138

CVE-2026-58138 — Conductor Unauthenticated RCE via GraalVM Evaluator -critical TL;DR: Orkes/OSS Conductor versions 3.21.21 to 3.30.2 evaluates user-supplied JavaScript in INLINE tasks using a GraalVM context with full host access HostAccess.ALL. Because the community API has no authentication by...

CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — Conductor RCE no autenticada a través del Evaluador GraalVM INLINE Conductor OSS / Orkes3.21.21 … antes de 3.30.2 evalúa JavaScript proporcionado por el usuario en tareas INLINE y LAMBDA / DOWHILE / SWITCH con un contexto de GraalVM construido con acceso completo al host...

vault-conductor

🗝️ vault-conductor An SSH Agent that provides SSH keys stored in Bitwarden Secret Manager as secrets. Supports SSH authentication and Git commit signing. Demo Features...

Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution

Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...

CVE-2026-58138

🚨 CVE-2026-58138 — Unauthenticated Remote Code Execution 🔥 Critical Unauthenticated Remote Code Execution in Conductor Affected versions:3.21.21 → 3.30.2 📌 Overview CVE-2026-58138 is a critical unauthenticated Remote Code Execution RCE...

CVE-2026-58138

CVE-2026-58138 — Conductor 3.21.21..3.30.2 未認証リモートコード実行 Orkes Conductor における重大なリモートコード実行の脆弱性 📋 概要 CVE-2026-58138 は、Orkes Conductor バージョン 3.21.21 から 3.30.1 に影響を与える、重大な未認証リモートコード実行（RCE）脆弱性です。この脆弱性により、攻撃者は認証を必要とせずに Conductor サーバー上で任意のコマンドを実行でき、システム全体が危険にさらされる可能性があります。 🔴 深刻度...

cve-2026-58138

CVE-2026-58138: RCE no autenticado en Conductor Kit de reproducción para CVE-2026-58138, una vulnerabilidad de inyección de código con CVSS 9.8 en Conductor. Contiene la regla de OpenTaint y las aproximaciones de GraalVM, pruebas de reglas aisladas, el resultado del escaneo y un exploit funcional...

GHSA-9XV2-5V5Q-P794 vulnerabilities

Vulnerabilities for packages: camunda, kayenta-fips, ontop-fips, ontop, camunda-zeebe, thingsboard, conductor, conductor-fips, nacos-docker, nacos, kayenta...

GHSA-H3X4-894J-XPX5 vulnerabilities

Vulnerabilities for packages: camunda, kayenta-fips, ontop-fips, ontop, camunda-zeebe, thingsboard, conductor, conductor-fips, nacos-docker, nacos, kayenta...

CVE-2026-65905 vulnerabilities

Vulnerabilities for packages: camunda, kayenta-fips, ontop-fips, ontop, camunda-zeebe, thingsboard, conductor, conductor-fips, nacos-docker, nacos, kayenta...

GHSA-GCX9-497G-6CP6 vulnerabilities

Vulnerabilities for packages: camunda, kayenta-fips, ontop-fips, ontop, camunda-zeebe, thingsboard, conductor, conductor-fips, nacos-docker, nacos, kayenta...

CVE-2026-68525 vulnerabilities

Vulnerabilities for packages: camunda, kayenta-fips, ontop-fips, ontop, camunda-zeebe, thingsboard, conductor, conductor-fips, nacos-docker, nacos, kayenta...

CVE-2026-65182 vulnerabilities

Vulnerabilities for packages: camunda, kayenta-fips, ontop-fips, ontop, camunda-zeebe, thingsboard, conductor, conductor-fips, nacos-docker, nacos, kayenta...

OrkesConductor 3.30.2 Remote Code Execution

OrkesConductor version 3.30.2 suffers from a remote code execution vulnerability. !/usr/bin/env python3 Exploit Title: OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution CVE: CVE-2026-58138 Date: 2026-07-10 Exploit Author: Mohammed Idrees Banyamer Author Country: Jordan Instagram:...

VulnCheck KEV: CVE-2026-58138

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

CVE-2026-58138

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

CVE-2026-58138

Orkes Conductor CVE-2026-58138 affects versions 3.21.21–3.30.1, where an INLINE task evaluating JavaScript in GraalVM with HostAccess.ALL allows unauthenticated remote code execution by reflecting to java.lang.Runtime and executing OS commands via the workflow API. Public templates and exploits c...

EUVD-2026-40377

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

CVE-2026-58138 Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...

CVE-2026-58138

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to...