Summary
Orkes Conductor versions prior to 3.30.2 are vulnerable to a critical unauthenticated remote code execution flaw (CVE-2026-58138) that allows attackers to run arbitrary OS commands via malicious workflow definitions.
Take Action:
If you run Orkes Conductor or Conductor OSS versions 3.21.21 through 3.30.1 (check your conductoross/conductor container images and Helm charts), update to 3.30.2 or later immediately. Working exploit code is public and attacks are already underway. Until you can patch, take the Conductor API off the internet, put it behind a reverse proxy that requires authentication and limit workflow endpoints to trusted internal networks only.
Read the full article on BeyondMachines
This article was originally published on BeyondMachines
Top comments (0)