Fortinet researchers have confirmed that CVE-2026-58138, a critical unauthenticated remote code execution vulnerability in Orkes Conductor, is being actively exploited in the wild. Orkes Conductor is an open-source workflow orchestration platform widely used for building and running distributed application workflows. The flaw requires no authentication — an attacker who can reach the Conductor API can execute arbitrary code on the host without any credentials or prior foothold on the system. A fix is available in Conductor version 3.30.2.
Orkes Conductor is commonly deployed as infrastructure glue in backend engineering environments, connecting microservices and coordinating automated jobs. Because Conductor instances are often trusted by downstream services and hold API keys or credentials for systems they orchestrate, a full compromise of an exposed Conductor node can cascade into a broader environment breach. Organizations running self-hosted Conductor instances exposed to the internet or to untrusted internal network segments should treat this as an emergency patch. If immediate patching is not possible, network controls should be put in place to restrict access to the Conductor API port until the upgrade is applied.
How to check if you’re affected
Affected versions include all Orkes Conductor releases before version 3.30.2. Check your deployment with conductor --version or by reviewing the release tag in your container image or build configuration. If your instance is running a version older than 3.30.2, it is vulnerable to CVE-2026-58138 and should be upgraded immediately. Instances not directly reachable from untrusted networks carry lower immediate risk, but patching is still mandatory given active exploitation reports.