## https://sploitus.com/exploit?id=E859DCD6-8883-5F4E-9C91-4E6ED29B01C1
# CVE-2026-58138: Conductor unauthenticated RCE
Reproduction kit for CVE-2026-58138, a CVSS 9.8 code-injection vulnerability in
[Conductor](https://github.com/conductor-oss/conductor). It contains the OpenTaint rule and
GraalVM approximations, isolated rule tests, the scan result, and a working exploit.
- [Read the case study](https://opentaint.org/blog/conductor-rce-cve-2026-58138/)
- [Open the interactive HTML report](https://opentaint.org/reports/conductor-cve-2026-58138.html)
- [View the included SARIF](results/report.sarif)
- [Get OpenTaint](https://github.com/seqra/opentaint)
The scan targets Conductor v3.23.0 and reports two findings from unauthenticated workflow input
to full-host-access GraalVM evaluators. Each finding contains four HTTP entry-point flows:
- `core/src/main/java/com/netflix/conductor/core/events/ScriptEvaluator.java:203`
- `core/src/main/java/com/netflix/conductor/core/execution/evaluators/PythonEvaluator.java:63`
## Contents
- `.opentaint/rules/` - the join rule and full-host-access `Context.eval` sink
- `.opentaint/model/config/` - passthrough models for GraalVM fluent builders
- `.opentaint/test-projects/` - 15 positive and negative rule samples
- `results/report.sarif` - the reproduced OpenTaint findings
- `poc/poc_inline_lambda_rce.py` - the live exploit
## Quick rule test
Requires [OpenTaint](https://github.com/seqra/opentaint#quick-start) and JDK 21.
```bash
opentaint compile \
.opentaint/test-projects/graaljs-polyglot-code-injection \
--output /tmp/conductor-rule-model
opentaint test rule run /tmp/conductor-rule-model \
--ruleset .opentaint/rules \
--passthrough-approximations .opentaint/model/config
```
Expected result: `Passed: 15, failed: 0`.
## Reproduce the scan
```bash
git clone --depth 1 --branch v3.23.0 \
https://github.com/conductor-oss/conductor.git conductor
opentaint scan ./conductor \
--ruleset builtin \
--ruleset .opentaint/rules \
--rule-id java/security/graaljs-polyglot-code-injection.yaml:graaljs-polyglot-code-injection \
--passthrough-approximations .opentaint/model/config \
--max-memory 16G \
--output results/report.sarif
opentaint summary results/report.sarif --show-findings
```
Expected result: two `java/security/graaljs-polyglot-code-injection` findings at the sinks
listed above. Use the full `:` value shown in the command so OpenTaint also
loads the source and sink rules referenced by the join.
## Reproduce the exploit
Start Conductor v3.23.0 with its default server configuration, then run:
```bash
# JavaScript INLINE task
python3 poc/poc_inline_lambda_rce.py --base-url http://localhost:8000
# Other supported paths
python3 poc/poc_inline_lambda_rce.py --task-type lambda --variant js
python3 poc/poc_inline_lambda_rce.py --task-type inline --variant python
```
The script exits with status `0` after it confirms command execution. The PoC also supports
`DO_WHILE` and `SWITCH`. Run it with `--help` for all options.
Conductor fixed the vulnerability in 3.30.2. See the
[case study](https://opentaint.org/blog/conductor-rce-cve-2026-58138/) for the vulnerable path,
exploit details, rule design, and patch analysis.