Executive brief
Orkes Conductor, a workflow orchestration engine, contains a critical security flaw that allows unauthorized users to take control of the server. By sending a specially crafted workflow request, an attacker can execute arbitrary commands on the underlying operating system without needing a username or password. This could lead to a total compromise of the system, including the theft of sensitive data or disruption of business operations.
Technical details
An unauthenticated remote code execution (RCE) vulnerability exists in Orkes Conductor due to improper sandboxing of script evaluators. The vulnerability resides in the workflow API endpoint, where attackers can submit inline workflow definitions containing malicious JavaScript or Python expressions. The root cause is the use of unsandboxed GraalVM evaluators configured with 'HostAccess.ALL' or 'allowAllAccess(true)'. By leveraging INLINE, LAMBDA, DO_WHILE, or SWITCH task types, an attacker can use Java reflection or direct subprocess calls to execute arbitrary system commands. The issue is addressed in version 3.30.2 by restricting host access and class loading within the script evaluators.
Affected products
- Orkes Conductor 3.21.21 before 3.30.2
Timeline
- 2026-06-03: patched: Version 3.30.2 released
- 2026-06-30: advisory: NVD and VulnCheck advisory published
References
- https://github.com/conductor-oss/conductor/commit/87a7d96aabbb706d6e84f812b93da5165028d18f
- https://github.com/conductor-oss/conductor/commit/c691e35e768caeb802c9f06ecdd9674c80081af1
- https://github.com/conductor-oss/conductor/releases/tag/v3.30.2
- https://www.cve.org/CVERecord?id=CVE-2025-26074
- https://www.vulncheck.com/advisories/orkes-conductor-unauthenticated-rce-via-graalvm-script-evaluators