CVE-2026–58138

Conductor is a workflow orchestration engine that allows users to execute user-defined JavaScript and Python expressions within INLINE tasks. The root cause of this vulnerability lies in a misconfiguration within this execution engine.

• Target Software: Orkes/OSS Conductor 3.21.21 ~ 3.30.1
• Patched Version: 3.30.2 (Commits 87a7d96, c691e35)
• Vulnerability Class: CWE-94 (Code Injection) — Unenforced GraalVM Polyglot Sandbox
• CVSS Score: 9.8 (Critical)

2. Technical Analysis Conductor utilizes the GraalVM Polyglot Context to execute scripts within INLINE tasks. In versions 3.29.x and lower, the script evaluator (ScriptEvaluator class) configures host access policy as follows when instantiating the context:

HostAccess.ALL permits the JavaScript engine unrestricted access to all methods and fields of Java host objects. While GraalVM natively provides sandboxing policies (e.g., HostAccess.EXPLICIT) that block reflection or arbitrary class loading by default, Conductor completely disabled these protections for convenience.

A similar flaw exists in the Python evaluator:

Reflection Chain — Why It Is Critical An INLINE task binds the task input value to the JavaScript variable $. Since $ is a native Java object, an attacker can leverage Java Reflection starting from this variable to reach arbitrary classes.

An attacker reaches the Java Runtime in just four steps from the $ object:

1. Call getClass() to obtain the java.lang.Class meta-object.
2. Load an arbitrary class via Class.forName("java.lang.Runtime").
3. Invoke Runtime.getRuntime().exec(…) to execute OS shell commands directly.

Under the HostAccess.ALL policy, this entire chain executes without any restriction.

Exploit Flow Public Proof-of-Concept (PoC) exploits complete unauthenticated attacks via three main steps:

1. Register Workflow — POST /api/metadata/workflow Embed reflection payload into the 'expression' field of the INLINE task. ↓
2. Execute Workflow — POST /api/workflow/{name} GraalVM engine evaluates the script and triggers the payload execution. ↓
3. Extract Results — Check stdout in task output Retrieve Runtime.exec execution results returned in the 'result' field.

Verified Impact Based on public PoC repositories, successful exploitation was verified against the vulnerable conductoross/conductor:3.22.3 image, returning uid=0(root). Considering that the Conductor process typically runs with elevated privileges, exploiting this single vulnerability can lead to:

• Complete compromise of the workflow engine
• Unauthorized access to connected datastores (Redis, PostgreSQL, Elasticsearch, etc.)
• Lateral movement into downstream systems triggered by workflows

Version Differences — Why Patching Was Delayed Until 3.30.2

• ~ 3.29.x: Retained allowHostAccess(HostAccess.ALL) — Completely defenseless.
• 3.30.0 ~ 3.30.1: Introduced a blocklist against specific reflection classes — Incomplete patch that remained bypassable.
• 3.30.2: Applied allowHostClassLoading(false) + Hardened the core execution engine — Fully patched.

3. Attack Demonstration (Proof of Concept) https://youtu.be/0Yl94lh0Yyc

4. Remediation & Mitigation Immediate Action: Upgrade Software Upgrade to Conductor 3.30.2 or higher. Starting from version 3.30.2, the JavaScript and Python evaluators operate with host access and class loading strictly disabled by default.

Defense in Depth To minimize operational risks and protect against similar vectors, implement the following security best practices:

Enforce Authentication & Access Control: Deploy an authentication gateway (e.g., OAuth 2.0, API Key validation) in front of public/community APIs to restrict unauthorized access.

Principle of Least Privilege: Run the Conductor application process under a non-root, dedicated service account with minimal permissions rather than elevated privileges.

Network-Level Segregation: Restrict access to workflow registration and execution endpoints (/api/metadata/workflow, /api/workflow) using network-level ACLs or firewall rules.