CVE-2026-58138: falha crítica em conductor-oss conductor
Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators
Publicada em · Atualizada em
90Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 9.3epss 15%
da publicação à arma0 dias
Publicada no NVD30 de jun.
1ª PoC30 de jun.
VulnCheck+27d
probabilidade de exploração
15%top 3% das CVEs
exploração observada
simVulnCheck
14 exploit(s) público(s)
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
conductor-oss · conductorPoCs públicas encontradas — 14
exploitdbwww.exploit-db.com/exploits/52633não verificadogithubgithub.com/0xBlackash/CVE-2026-58138★ 3githubgithub.com/Ch4120N/CVE-2026-58138★ 2githubgithub.com/Ez4rd1x1/CVE-2026-58138-Research★ 0githubgithub.com/0xgh057r3c0n/CVE-2026-58138★ 0githubgithub.com/seqra/cve-2026-58138★ 0githubgithub.com/BiiTts/CVE-2026-58138-Conductor-Unauth-RCE★ 0githubgithub.com/Procjevt/CVE-2026-58138★ 0vulncheckvulncheck.com/xdb/c26aee61c022não verificadovulncheckvulncheck.com/xdb/4f99706cfc74não verificadovulncheckvulncheck.com/xdb/0eb9ba83a244não verificadovulncheckvulncheck.com/xdb/eb7362a14121não verificadovulncheckvulncheck.com/xdb/17e059b66c88não verificadovulncheckvulncheck.com/xdb/06cfaea3bf99não verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/conductor-oss/conductor/commit/87a7d96aabbb706d6e84f812b93da5165028d18fhttps://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1https://github.com/conductor-oss/conductor/releases/tag/v3.30.2https://www.cve.org/CVERecord?id=CVE-2025-26074https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators