For: teams that run Conductor (conductor-oss, also called Orkes Conductor) on their own servers or containers, including for AI agent workflows. This page is based on the CVE record, NVD, the project's release notes, CISA's KEV catalog and a security vendor's alert; it contains no attack steps or exploit code.
Developing: this page will be updated as more is published
- Who is affected
teams that run Conductor (conductor-oss, also called Orkes Conductor) on their own servers or containers, including for AI agent workflows.
- Confirmed so farSee the table ↓
- Affected and fixed versions
- No authentication needed
- Attack attempts in the wild
- Not yet confirmed
- Whether any attack attempt has led to a confirmed compromise
- A security advisory or statement from the project or Orkes
- Whether Orkes' hosted or enterprise offering is affected
2 more
- NVD's own analysis (status: Deferred)
- Whether CISA adds it to the KEV catalog
- What to do nowSee the steps ↓
- Find your Conductor servers and their versions
- Update to 3.30.2 or later
- Keep the workflow API off the internet
1 more
- If an affected version was reachable, check it as possibly compromised
- Where to verify (source)All sources ↓
- NVD, CVE-2026-58138
- Last checked
- As of October 31, 2026 (JST)
Follow-up plans and what we checked
The CVE record and the fixed release are public. The security vendor's figures are from September. We checked NVD, the GitHub releases, the project's security advisories and CISA's KEV feed on October 31.
What to do today
Find your Conductor servers and their versions
Look for the Conductor server in your container images, Helm charts, Compose files and build files, and note the version tag. Affected: 3.21.21 up to but not including 3.30.2. Do not forget test, staging and proof-of-concept servers set up for AI agent work.
Update to 3.30.2 or later
3.30.2 contains the fix. The latest stable release on October 31 is 3.33.0 (October 26). If you cannot update today, take the server off the internet until you can.
Keep the workflow API off the internet
The security vendor advises restricting exposure of the workflow API. Put the server on a private network, allow only the systems that need it, and require authentication in front of it (for example a reverse proxy or API gateway). An update fixes this flaw; restricting access also limits the next one.
If an affected version was reachable, check it as possibly compromised
Attack attempts were counted in early September, and public exploit code was published in August, according to the vendor. In general terms (our suggestion): look for workflow definitions that nobody on your team created, unexpected processes started by the Conductor server, unusual outbound connections, and new files or scheduled jobs on the host.
Rotate the credentials the server can read, such as database, queue and API keys for AI providers. If you find anything you cannot explain, rebuild the host from a clean image rather than cleaning it in place.
What was disclosed
- Product
- Conductor, an open-source workflow engine for applications and AI agents (conductor-oss/conductor; "Orkes Conductor" in the CVE record)
- Type
- Code injection (CWE-94). The JavaScript and Python script evaluators were not sandboxed, so expressions in a submitted workflow definition could reach the operating system
- Authentication
- Not required (CVE record)
- Severity
- CVSS v3.1 9.8, CVSS v4.0 9.3 (scores from the CVE numbering authority, a security vendor)
- Affected
- 3.21.21 up to but not including 3.30.2
- Fixed
- 3.30.2 (released June 3, 2026)
- Exploitation
- A network security vendor reports blocked attack attempts (1,290 in 24 hours; 6,696 in seven days, September 2026). No confirmed compromise published
- NVD / KEV
- NVD status Deferred (last modified October 25). Not in CISA's KEV catalog on October 31
1. Find versions
3.21.21 to 3.30.1 are affected
2. Update and restrict
3.30.2 or later; API on a private network
3. Review exposed servers
Unknown workflows, processes, connections; rotate keys
Timeline
May 22, 2026
A change titled "Restrict graaljs further" (restricting the JavaScript engine) is merged into the project.June 3
Release 3.30.2 ships with that change. The notes do not mention a security fix or CVE.June 30
CVE-2026-58138 is published, with 3.30.2 as the fixed version.August 9
Public exploit code is published, according to the security vendor's alert.September 9
The security vendor reports 1,290 blocked attack attempts in 24 hours (a 132% daily increase) and 6,696 in seven days.September 15
The vendor publishes an outbreak alert advising an update to 3.30.2 or later. A security news site later reports the count as nearly 7,000 attempts in a week.October 31
Not in CISA's KEV catalog; NVD status Deferred.
What is known and not known
| Item | What the sources say | Status |
|---|---|---|
| Affected and fixed versions | 3.21.21 to before 3.30.2; fixed in 3.30.2 | Confirmed (CVE record) |
| No authentication needed | Stated in the CVE record | Confirmed (CVE record) |
| Attack attempts in the wild | Blocked attempts counted by a security vendor | Confirmed (security vendor) |
| Successful compromises | None published in the sources we checked | Not stated |
| Advisory or statement from the project or Orkes | None found on GitHub; release notes only | Not stated |
| Orkes' hosted or enterprise offering | Not covered by the CVE record | Not stated |
| CISA KEV | Not listed as of October 31 | Not stated |
| NVD analysis | Status Deferred | Not stated |
Why this one is easy to miss
Three things combine here. The fix shipped without a security label, so teams that track only advisories had nothing to act on. The CVE then went into NVD's Deferred queue and has no KEV entry, so dashboards that rank by those signals rank it low. And a workflow engine set up for an AI agent project can sit outside the usual patch inventory.
This is the same lesson as the Metabase breaches: an internal tool that holds many credentials, reachable from the internet, exploited without logging in. If your vulnerability triage depends on KEV, add exploitation reports from the developer or security vendors as a trigger too (see how to decide which CVEs to fix first).
Sources
Checked on October 31, 2026 (JST).
- NVD, CVE-2026-58138 — nvd.nist.gov
- conductor-oss/conductor, release v3.30.2 (June 3, 2026) — github.com
- CVE numbering authority's advisory (a security vendor) — vulncheck.com
- Security vendor's threat signal report (September 9, 2026) — fortiguard.com
- Security vendor's outbreak alert (September 15, 2026) — fortiguard.com
- CISA, Known Exploited Vulnerabilities Catalog (checked October 31; not listed) — cisa.gov
- Security news report (September 22, 2026) — esecurityplanet.com
Update history
2026-10-31: First version, based on NVD, the project's release notes, CISA's KEV catalog and a security vendor's alert.
Read next
- A similar case: Metabase vulnerability breaches
- Prioritising fixes: How to decide which CVEs to fix first (CVSS, EPSS, KEV)
- Response steps: Vulnerability remediation playbook
- Terms: What is remote code execution (RCE)? / What is CVSS?
- AI-related attacks: Defending against AI-driven attacks