2026-10-31
Orkes Conductor CVE-2026-58138: unauthenticated OS command execution, with attack attempts observed (update to 3.30.2 or later)
CVE-2026-58138 is a flaw in Conductor, the open-source workflow engine from the conductor-oss project that the CVE record calls Orkes Conductor. In versions 3.21.21 up to but not including 3.30.2, a remote attacker can execute operating system commands without authentication by submitting a workflow definition containing JavaScript or Python expressions to the workflow API, because the script evaluators were not sandboxed. The CVE was published on June 30, 2026 with CVSS 9.8 (v3.1) and 9.3 (v4.0). The fix is in release 3.30.2 of June 3, whose notes describe it only as restricting the JavaScript engine further. A network security vendor reported in September that its intrusion prevention service blocked 1,290 attack attempts in one day and 6,696 in seven days. These are blocked attempts, not confirmed compromises. As of October 31 the CVE is not in CISA's KEV catalog and NVD has not analysed it (status Deferred). Our conclusion: if you run Conductor yourself, move to 3.30.2 or later now, keep its API off the internet, and if an affected version was reachable, review it as possibly compromised.