Conductor-oss vulnerabilities
We track 3 vulnerabilities in Conductor-oss products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 13, 2026.
Latest Conductor-oss vulnerabilities
- 7.3 High severity
conductor: Server-Side Request Forgery
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argumen
- 7.3 High severity
conductor: Server-Side Request Forgery
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching.
- 9.8 Critical severity
conductor: Improper Control of Generation of Code
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions