conductor vulnerabilities
CVEs whose affected-version data names the conductor package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-109405High· 7.3A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The mani…
CVE-2026-109404Medium· 5.3PoCA vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10
A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server…
CVE-2026-109403High· 7.3PoCA vulnerability was determined in conductor-oss conductor up to 3.32.5
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the componen…
CVE-2026-109402Medium· 6.3PoCA vulnerability was found in conductor-oss conductor 3.22.0
A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipula…
CVE-2026-109190Medium· 6.3A vulnerability has been found in conductor-oss conductor 3.31.2
A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads …