conductor-oss has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was October 2026 with 5. The median CVSS is 6.3 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-918 (5).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Weakness classes
Products
- conductor 5
Worst active — by depth score
CVE-2026-109403High· 7.3A vulnerability was determined in conductor-oss conductor up to 3.32.552CVE-2026-109402Medium· 6.3A vulnerability was found in conductor-oss conductor 3.22.047CVE-2026-109404Medium· 5.3A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc1041CVE-2026-109405High· 7.3A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc1040CVE-2026-109190Medium· 6.3A vulnerability has been found in conductor-oss conductor 3.31.235
conductor-oss vulnerabilities
CVEs affecting conductor-oss, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-109405High· 7.3A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The mani…
CVE-2026-109404Medium· 5.3PoCA vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10
A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server…
CVE-2026-109403High· 7.3PoCA vulnerability was determined in conductor-oss conductor up to 3.32.5
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the componen…
CVE-2026-109402Medium· 6.3PoCA vulnerability was found in conductor-oss conductor 3.22.0
A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipula…
CVE-2026-109190Medium· 6.3A vulnerability has been found in conductor-oss conductor 3.31.2
A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads …