[06:31:18] === CVE-2026-58138 reproduction ===
[06:31:18] vulnerable image: conductoross/conductor:3.22.3 | fixed image: conductoross/conductor:3.30.2
[06:31:18] ensuring docker images are present ...
[06:31:23] 
[06:31:23] ########## PHASE 1: VULNERABLE Conductor 3.22.3 ##########
[06:31:23] started conductor-vuln-repro (image conductoross/conductor:3.22.3)
[06:31:23] detected target (sandbox -> host-network conductor): 172.20.0.1:8080
[06:31:23] waiting for conductor-vuln-repro health at http://172.20.0.1:8080/health ...
[06:31:36] conductor-vuln-repro is healthy (HTTP 200) after ~16s
[06:31:36] unauthenticated GET /api/metadata/workflow -> HTTP 200 (expect 200, no auth)
[06:31:36] running unauthenticated RCE exploit against vulnerable conductor ...
[06:31:39] vulnerable exploit exit code: 0
[06:31:40] marker file present inside container: 'PRUVA_RCE_CONFIRMED_1783233078'
[06:31:40] vulnerable task_status=COMPLETED rce_confirmed=True
[06:31:40] vulnerable command output (first lines): uid=0(root) gid=0(root) groups=0(root)
PRUVA_RCE_CONFIRMED_1783233078
muramasa
[06:31:40] >>> VULNERABLE: unauthenticated RCE CONFIRMED (in-band output + marker file)
[06:31:50] 
[06:31:50] ########## PHASE 2: FIXED Conductor 3.30.2 (negative control) ##########
[06:31:51] started conductor-fixed-repro (image conductoross/conductor:3.30.2)
[06:31:51] waiting for conductor-fixed-repro health at http://172.20.0.1:8080/health ...
[06:31:59] conductor-fixed-repro is healthy (HTTP 200) after ~12s
[06:31:59] running identical exploit against FIXED conductor (expect blocked) ...
[06:32:03] fixed exploit exit code: 1 (expect 1 = not confirmed)
[06:32:03] fixed task_status=FAILED_WITH_TERMINAL_ERROR rce_confirmed=False
[06:32:03] fixed task result (first lines): 
[06:32:03] >>> FIXED: RCE BLOCKED (task did not complete with command output, no marker file)
[06:32:13] 
[06:32:13] === VERDICT ===
[06:32:13] vulnerable RCE confirmed : true
[06:32:13] fixed build blocked      : true
[06:32:13] RESULT: CVE-2026-58138 CONFIRMED (unauthenticated RCE on 3.22.3, blocked on 3.30.2)
[06:32:13] runtime manifest written to /data/pruva/runs/78bac993-57aa-4d07-ae6a-e903103398fb/bundle/repro/runtime_manifest.json
[06:32:13] === reproduction SUCCESS ===