CVE-2026-58138: fallo crítico en conductor-oss conductor
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
Publicada el · Actualizada el
90Vexday Risk Score
Corrige ahora. Ella explotación observada por VulnCheck y tiene exploit funcional público.
ssvc Actcvss 9.3epss 15%
de la publicación al arma0 días
Publicada en NVD30 jun
1ª PoC30 jun
VulnCheck+27d
probabilidad de explotación
15%top 3% de las CVE
explotación observada
síVulnCheck
14 exploit(s) público(s)
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
conductor-oss · conductorPoCs públicas encontradas — 14
exploitdbwww.exploit-db.com/exploits/52633no verificadogithubgithub.com/0xBlackash/CVE-2026-58138★ 3githubgithub.com/Ch4120N/CVE-2026-58138★ 2githubgithub.com/Ez4rd1x1/CVE-2026-58138-Research★ 0githubgithub.com/0xgh057r3c0n/CVE-2026-58138★ 0githubgithub.com/seqra/cve-2026-58138★ 0githubgithub.com/BiiTts/CVE-2026-58138-Conductor-Unauth-RCE★ 0githubgithub.com/Procjevt/CVE-2026-58138★ 0vulncheckvulncheck.com/xdb/c26aee61c022no verificadovulncheckvulncheck.com/xdb/4f99706cfc74no verificadovulncheckvulncheck.com/xdb/0eb9ba83a244no verificadovulncheckvulncheck.com/xdb/eb7362a14121no verificadovulncheckvulncheck.com/xdb/17e059b66c88no verificadovulncheckvulncheck.com/xdb/06cfaea3bf99no verificado⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
Referencias
https://github.com/conductor-oss/conductor/commit/87a7d96aabbb706d6e84f812b93da5165028d18fhttps://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1https://github.com/conductor-oss/conductor/releases/tag/v3.30.2https://www.cve.org/CVERecord?id=CVE-2025-26074https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators