We're sharing our deep dive into CVE-2026-58138, a critical unauthenticated RCE in Conductor with a CVSS score of 9.8, where a single POST request can lead to arbitrary OS command execution on the server. The post walks through how the vulnerability reaches GraalJS and GraalPy evaluators, how we reproduced it across multiple workflow task types, and how OpenTaint traced the complete path from HTTP input to code execution. If you run Conductor, upgrade to version 3.30.2 or later, and take a look at the full technical analysis: opentaint.org/blog/conductor…