conductor vulnerabilities
3 known vulnerabilities in conductor from Conductor-oss. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.3 High severity
conductor: Server-Side Request Forgery
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argumen
- 7.3 High severity
conductor: Server-Side Request Forgery
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching.
- 9.8 Critical severity
conductor: Improper Control of Generation of Code
Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary OS commands by submitting inline workflow definitions containing malicious JavaScript or Python expressions