Vulnerabilities

TI-2026-71645 CVE-2026-109405 · GHSA-8q7f-vg4q-39mm

Server-side request forgery in conductor-oss Conductor Kafka task

LOW 30

A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00278 Published 2026-10-13 No fix listed CWE-918

TI-2026-71644 CVE-2026-109404 · GHSA-fhq7-8m85-r6m9

conductor-oss conductor Agentspan Agent Runtime server-side request forgery

HIGH 70

A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00452 Published 2026-10-13 No fix listed CWE-918

TI-2026-71643 CVE-2026-109403 · GHSA-5469-w5gg-3qjr

Server-side request forgery in conductor-oss Agent Card fetching

HIGH 70

A vulnerability was determined in conductor-oss conductor up to 3.32.5.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00354 Published 2026-10-13 No fix listed CWE-918

TI-2026-71638 CVE-2026-109402

Server-side request forgery in conductor-oss Conductor MCP Service

MEDIUM 57

A vulnerability was found in conductor-oss conductor 3.22.0.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00256 Published 2026-10-13 No fix listed CWE-918

TI-2026-71637 CVE-2026-109190

Server-side request forgery in conductor-oss Conductor API tools

LOW 24

A vulnerability has been found in conductor-oss conductor 3.31.2.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00256 Published 2026-10-13 No fix listed CWE-918

TI-2026-41860 CVE-2026-58138 · GHSA-7x5q-8f6h-rjrc

Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators

MEDIUM 60

Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing mal…

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.09143 Published 2026-06-30 Fixed in 3.30.2 CWE-94