Orkes Conductor RCE CVE-2026-58138 Exploited in Attacks

Orkes is dealing with an actively exploited critical flaw in its Conductor workflow orchestration platform. The attack requires no authentication.

CVE-2026-58138 carries a CVSS score of 9.8. An unauthenticated attacker can execute code on the server by submitting crafted inline workflow definitions to the API. SecurityWeek confirmed Wednesday that exploitation is already occurring in the wild.

Orkes Conductor is a managed cloud platform built on Netflix’s open-source Conductor framework, used by engineering teams to coordinate microservices and automate multi-step workflows. Deployments typically carry broad access to internal APIs and service credentials; that access profile is what makes a pre-auth RCE here consequential beyond the compromised server itself. Whoever owns the orchestrator inherits whatever the orchestrator was trusted to reach.

Workflow orchestration platforms have attracted this class of attack before. Attackers exploited a pre-auth RCE in Langflow earlier this year to extract OpenAI and AWS credentials from affected environments. When Artifactory vulnerabilities were chained into backdoor campaigns this month, the underlying logic was the same: attack the service that other services trust. Orchestration and build infrastructure fit that description.

Consult the NVD entry for CVE-2026-58138 and the Orkes security advisory for affected version ranges and available patches. If a fix is not yet available in your environment, restrict network access to the Conductor API to trusted sources and treat anomalous workflow execution as a potential incident. Pre-auth RCE in a service that holds live credentials is not a patch to defer.