What’s Vulnerable › Products

conductor-oss conductor vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your conductor-oss conductor version is affected

Latest conductor-oss conductor vulnerabilities

• CVE-2026-109405 — conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery (CVSS 7.3)
• CVE-2026-109404 — conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery (CVSS 5.3)
• CVE-2026-109403 — conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery (CVSS 7.3)
• CVE-2026-109402 — conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery (CVSS 6.3)
• CVE-2026-109190 — conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery (CVSS 6.3)
• CVE-2026-58138 — Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators (CVSS 9.8)