CYBERSECURITYTRACKER
Permanent story citation

Critical Orkes Conductor Vulnerability Exploited in Attacks

This page keeps the story as Cybersecurity Tracker first published it. If the tracker later corrects it, the correction appears below the original and never replaces it.

Back to newsStory 7729

As cited

Copy frozen at (site build).

vulnerabilities

Critical Orkes Conductor Vulnerability Exploited in Attacks

CVE-2026-58138 is an unauthenticated remote code execution (RCE) vulnerability in Orkes Conductor that can be exploited through inline workflow definitions. The flaw has been observed in active attacks against deployments.

Why it matters: Organizations running Orkes Conductor are exposed to unauthenticated RCE without authentication; patching is critical to prevent immediate compromise.

CVEsCVE-2026-58138
Source published
First seen by Cybersecurity Tracker

Source attribution

Correction

Correction recorded as of .

vulnerabilities

Critical Orkes Conductor Vulnerability Exploited in Attacks

CVE-2026-58138 is an unauthenticated remote code execution (RCE) vulnerability in Orkes Conductor that can be exploited through inline workflow definitions. The flaw has been observed in active attacks against deployments.

Why it matters: Organizations running Orkes Conductor are exposed to unauthenticated RCE without authentication; patching is critical to prevent immediate compromise.

CVEsCVE-2026-58138
Source published
First seen by Cybersecurity Tracker

Source attribution

Glossary

Open in glossary