Orkes Conductor 3.21.21 — CVE-2026-58138 (Critical)

Date Jun 30, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product Orkes · Conductor 3.21.21

CVE CVE-2026-58138

Critical vendor advisory CVE-2026-58138

Summary

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed GraalVM evaluators configured with HostAccess.ALL or allowAllAccess(true) through INLINE, LAMBDA, DO_WHILE, and SWITCH task types to invoke arbitrary system commands via Java reflection or direct subprocess calls.

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.8) in Orkes Conductor 3.21.21. Patch or mitigate promptly.

Operator check

Review CVE-2026-58138 in your asset inventory. Apply patches per vendor guidance and verify Conductor 3.21.21 is not exposed. CVSS score: 9.8.

Sources

NVD — CVE-2026-58138 Source reference Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed