NPM · SEPTEMBER 2026 · EARLY WARNING

Critical Orkes Conductor Vulnerability CVE-2026-58138 Under Attack

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.
Severity
HIGH
Affected component
orkes conductor (npm)
Affected versions
>= v3.30.0.rc16, <= v3.30.0.rc16 or >= v3.30.0.rc3, <= v3.30.0.rc3 or >= v3.31.0-rc.1, <= v3.31.0-rc.1 or >= v3.30.1, <= v3.30.1 or >= v3.30.0.rc18, <= v3.30.0.rc18 or >= v3.30.0, <= v3.30.0 or >= v3.30.0.rc17, <= v3.30.0.rc17 or >= v3.30.0.rc15, <= v3.30.0.rc15 or >= v3.30.0.rc14, <= v3.30.0.rc14 or >= v3.30.0.rc13, <= v3.30.0.rc13 or >= v3.30.0.rc12, <= v3.30.0.rc12 or >= v3.30.0.rc10, <= v3.30.0.rc10 or >= v3.30.0.rc9, <= v3.30.0.rc9 or >= v3.30.0.rc7, <= v3.30.0.rc7 or >= v3.30.0.rc6, <= v3.30.0.rc6 or >= v3.30.0.rc5, <= v3.30.0.rc5 or >= v3.30.0.rc4, <= v3.30.0.rc4 or >= v3.30.0.rc2, <= v3.30.0.rc2 or >= v3.30.0.rc1, <= v3.30.0.rc1 or >= v3.3.0.rc8, <= v3.3.0.rc8 or >= v3.3.0.rc7, <= v3.3.0.rc7 or >= v3.3.0.rc6, <= v3.3.0.rc6 or >= v3.3.0.rc5, <= v3.3.0.rc5 or >= v3.3.0.rc4, <= v3.3.0.rc4 or >= v3.3.0.rc3, <= v3.3.0.rc3 or >= v3.23.0, <= v3.23.0 or >= v3.22.3, <= v3.22.3 or >= v3.22.2, <= v3.22.2 or >= v3.22.1, <= v3.22.1 or >= v3.22.0, <= v3.22.0 or >= v3.22.0-beta, <= v3.22.0-beta or >= v3.21.24-rc.1, <= v3.21.24-rc.1 or >= v3.21.23, <= v3.21.23 or >= v3.21.22, <= v3.21.22 or >= v3.21.21, <= v3.21.21
Patched version
Not yet available
CVE-2026-58138

An early warning has been issued for CVE-2026-58138, a critical-severity vulnerability in Orkes Conductor that attackers are reportedly exploiting in the wild.

What happened

CVE-2026-58138 is an unauthenticated remote code execution vulnerability that attackers can exploit via inline workflow definitions submitted to the workflow API endpoint. Attackers can include malicious JavaScript or Python expressions in the definitions to invoke arbitrary code. This vulnerability affects a wide range of Orkes Conductor versions, as detailed in the affected components section below.

To assess your exposure, check if your organization uses Orkes Conductor and review the affected version ranges. If you are using a vulnerable version, it is recommended to upgrade to the latest version and review workflow definitions for any suspicious inline code.

What to do about it

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If orkes conductor is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

You are affected if you are using Orkes Conductor version >= v3.30.0.rc16, <= v3.30.0.rc16 or >= v3.30.0.rc3, <= v3.30.0.rc3 or >= v3.31.0-rc.1, <= v3.31.0-rc.1 or >= v3.30.1, <= v3.30.1 or >= v3.30.0.rc18, <= v3.30.0.rc18 or >= v3.30.0, <= v3.30.0 or >= v3.30.0.rc17, <= v3.30.0.rc17 or >= v3.30.0.rc15, <= v3.30.0.rc15 or >= v3.30.0.rc14, <= v3.30.0.rc14 or >= v3.30.0.rc13, <= v3.30.0.rc13 or >= v3.30.0.rc12, <= v3.30.0.rc12 or >= v3.30.0.rc10, <= v3.30.0.rc10 or >= v3.30.0.rc9, <= v3.30.0.rc9 or >= v3.30.0.rc7, <= v3.30.0.rc7 or >= v3.30.0.rc6, <= v3.30.0.rc6 or >= v3.30.0.rc5, <= v3.30.0.rc5 or >= v3.30.0.rc4, <= v3.30.0.rc4 or >= v3.30.0.rc2, <= v3.30.0.rc2 or >= v3.30.0.rc1, <= v3.30.0.rc1 or >= v3.3.0.rc8, <= v3.3.0.rc8 or >= v3.3.0.rc7, <= v3.3.0.rc7 or >= v3.3.0.rc6, <= v3.3.0.rc6 or >= v3.3.0.rc5, <= v3.3.0.rc5 or >= v3.3.0.rc4, <= v3.3.0.rc4 or >= v3.3.0.rc3, <= v3.3.0.rc3 or >= v3.23.0, <= v3.23.0 or >= v3.22.3, <= v3.22.3 or >= v3.22.2, <= v3.22.2 or >= v3.22.1, <= v3.22.1 or >= v3.22.0, <= v3.22.0 or >= v3.22.0-beta, <= v3.22.0-beta or >= v3.21.24-rc.1, <= v3.21.24-rc.1 or >= v3.21.23, <= v3.21.23 or >= v3.21.22, <= v3.21.22 or >= v3.21.21, <= v3.21.21.

What should I do right now?

Upgrade to the latest version of Orkes Conductor and review workflow definitions for any suspicious inline code.

Has this been exploited in the wild?

Yes, this vulnerability is reportedly being exploited in attacks.

Sources

Join the 0Day waitlist →

← Back to all threats