Vulnerabilidades do Conductor-oss Conductor

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Conductor-oss Conductor: 6 registro(s), com versões afetadas e correções.

CVE-2026-109405 Alta · 7.3 CWE-918 13/10/2026

conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery

A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

CVE-2026-109404 Média · 5.3 CWE-918 13/10/2026

conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery

A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible.

CVE-2026-109403 Alta · 7.3 CWE-918 13/10/2026

conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery

A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-109402 Média · 6.3 CWE-918 13/10/2026

conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery

A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used.

CVE-2026-109190 Média · 6.3 CWE-918 13/10/2026

conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery

A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-58138 Crítica · 9.8 Exploit público CWE-94 30/06/2026

Orkes Conductor: injeção de código não autenticada com RCE via avaliadores GraalVM

O Orkes Conductor 3.21.21 antes da 3.30.2 contém uma vulnerabilidade de execução remota de código não autenticada que permite a atacantes remotos executar comandos arbitrários do sistema operacional ao submeter definições de workflow inline contendo expressões JavaScript ou Python maliciosas ao endpoint da API de workflow antes da autenticação. Atacantes podem explorar avaliadores GraalVM sem sandbox configurados com HostAccess.ALL ou allowAllAccess(true) por meio dos tipos de tarefa INLINE, LAMBDA, DO_WHILE e SWITCH para invocar comandos arbitrários do sistema via reflexão Java ou chamadas diretas a subprocessos.