Vulnerabilities in conductor-oss
6 resultsCVE-2026-58138CRITICALOrkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script EvaluatorsEPSS 14.7%CVE-2026-109404MEDIUMconductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgeryEPSS —CVE-2026-109190MEDIUMconductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgeryEPSS —CVE-2026-109402MEDIUMconductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgeryEPSS —CVE-2026-109403MEDIUMconductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgeryEPSS —CVE-2026-109405MEDIUMconductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgeryEPSS —