Impact
CVE-2026-58138 is a critical pre-authentication remote code execution vulnerability in Orkes Conductor [S1]. It can allow a network attacker without credentials to run operating-system commands on the affected Conductor host, with potentially severe confidentiality, integrity, and availability impact [S1]. The GitHub Advisory Database records a CVSS v4 score of 9.3 and classifies the weakness as CWE-94, Improper Control of Generation of Code [S1].
Root Cause
The vulnerable behavior involves externally supplied workflow expressions reaching JavaScript or Python evaluators with unsafe host access [S1]. The upstream hardening change restricts JavaScript class access and denies host access in the Python evaluator, reducing the ability of evaluated expressions to reach sensitive host functionality [S3].
Affected and Fixed Versions
The advisory identifies Orkes Conductor versions from 3.21.21 up to, but not including, 3.30.2 as affected [S1]. The upstream 3.30.2 release includes the evaluator restriction work, so operators should treat 3.30.2 as the minimum fixed release and prefer the latest supported release available for their deployment [S1][S2].
Concrete Fixes
Upgrade every affected Orkes Conductor deployment to version 3.30.2 or later [S1][S2]. Confirm the running version after rollout, replace outdated container images or deployment references, and ensure administrative and workflow interfaces are not exposed more broadly than required [S2]. Review host and application logs for unexpected workflow changes or command execution, rotate credentials accessible to the service if compromise is suspected, and rebuild affected hosts from trusted images where incident evidence warrants it [S1].
Why FixVibe will not check this automatically
A passive web response does not reliably disclose the exact Orkes Conductor version, and frontend or header fingerprints would not provide strong enough evidence that a deployment is vulnerable [S1]. Confirming the flaw dynamically would require submitting workflow or evaluator content and observing code execution, which crosses FixVibe's safe scanning boundary [S1]. Organizations should verify the installed version from deployment inventory and upgrade affected systems directly [S1][S2].