Security Feed
See the latest insights and analysis from our MDR team.
RSS for SlackCVE-2026-58138
By Yuval Cohen |
20 September 2026
CVE-2026-58138 – Orkes Conductor workflow API inline scripts enable unauthenticated OS command execution
Orkes Conductor 3.21.21 before 3.30.2 allows unauthenticated RCE when attackers submit inline workflow definitions with malicious JavaScript/Python expressions to the workflow API endpoint before authentication. Unsandboxed GraalVM evaluators (HostAccess.ALL/allowAllAccess(true)) in INLINE, LAMBDA, DO_WHILE, SWITCH can run OS commands via reflection/subprocess. Upgrade to 3.30.2 to mitigate.