Conductor-Oss Conductor vulnerabilities

CVE-2026-58138 [CRITICAL] CWE-94 CVE-2026-58138: Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerabilit Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions to the workflow API endpoint prior to authentication. Attackers can exploit unsandboxed Gr

CVE-2026-109403 [HIGH] CWE-918 CVE-2026-109403: A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerabili A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery.

CVE-2026-109405 [HIGH] CWE-918 CVE-2026-109405: A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the f A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be

CVE-2026-109190 [MEDIUM] CWE-918 CVE-2026-109190: A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiT A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclose

CVE-2026-109402 [MEDIUM] CWE-918 CVE-2026-109402: A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.lis A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side request forgery. The attack may be initiated remotely. The

CVE-2026-109404 [MEDIUM] CWE-918 CVE-2026-109404: A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible.