OrkesConductor 3.30.2 – Unauthenticated Remote Code Execution (CVE‑2026‑58138)
What Happened — A critical remote‑code‑execution flaw (CVSS 9.8) was disclosed for Orkes Conductor OSS versions 3.21.21 through 3.30.1. The vulnerability (CVE‑2026‑58138) allows an attacker to execute arbitrary commands on the Conductor host without authentication by submitting malicious inline JavaScript tasks that abuse an unsandboxed GraalVM HostAccess.ALL configuration.
Why It Matters for Compliance & Audit Readiness
- The flaw bypasses the “least‑privilege” and “segregation of duties” controls that SOC 2 Security principles require for service‑provider environments.
- Continuous‑control monitoring must capture configuration drift (e.g., unsandboxed GraalVM settings) to provide audit‑ready evidence that the environment remains within the defined security baseline.
- Mapping this vulnerability to the relevant SOC 2 control (CC6.1 System Operations) demonstrates due‑diligence and supports a defensible audit trail.
Who Is Affected — SaaS and on‑premise platforms that embed Orkes Conductor for workflow orchestration, spanning technology, financial services, and healthcare developers.
Recommended Actions
- Immediately upgrade to Conductor 3.30.2 or later, which disables the unsafe
HostAccess.ALLdefault. - Review and harden GraalVM sandbox configurations; enforce “deny‑all” policies for host access.
- Map the configuration control to SOC 2 CC6.1, capture the remediation ticket and patch status as continuous evidence for audit readiness.
Technical Notes — The exploit leverages unauthenticated API calls that inject malicious JavaScript, triggering Java reflection and Runtime.exec. It runs with the privileges of the Conductor process (often root in Docker containers). CVE‑2026‑58138, CVSS 9.8, fixed in version 3.30.2. Source: Exploit‑DB 52633