Orkes Conductor 3.21.21-3.30.1 - Remote Code Execution

Orkes Conductor from 3.21.21 before 3.30.2 is vulnerable to unauthenticated remote code execution. The INLINE workflow task evaluates a user-supplied JavaScript expression in a GraalVM context created with HostAccess.ALL, so an unauthenticated attacker can reflect from the bound input object to...

CVE-2026-58138

CVE-2026-58138 — Conductor Unauthenticated RCE via GraalVM Evaluator -critical TL;DR: Orkes/OSS Conductor versions 3.21.21 to 3.30.2 evaluates user-supplied JavaScript in INLINE tasks using a GraalVM context with full host access HostAccess.ALL. Because the community API has no authentication by...

CVE-2026-58138

CVE-2026-58138 — Conductor 3.21.21..3.30.2 Unauthenticated Remote Code Execution Critical Remote Code Execution Vulnerability in Orkes Conductor 📋 Overview CVE-2026-58138 is a critical unauthenticated Remote Code Execution RCE vulnerability affecting Orkes Conductor versions 3.21.21 through 3.30....

vault-conductor

🗝️ vault-conductor An SSH Agent that provides SSH keys stored in Bitwarden Secret Manager as secrets. Supports SSH authentication and Git commit signing. Demo Features It implements the SSH Agent Protocol as a Unix domain socket server, acting as a secure bridge between your SSH clients and...

opentaint

The open source taint analysis engine for the AI era Formal taint analysis for application security — finds what AST-pattern matchers miss, lets LLM agents enact rules from vulnerabilities, scales where neither can alone. English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dan...

CVE-2026-58138

🚨 CVE-2026-58138 — Unauthenticated Remote Code Execution 🔥 Critical Unauthenticated Remote Code Execution in Conductor Affected versions:3.21.21 → 3.30.2 📌 Overview CVE-2026-58138 is a critical unauthenticated Remote Code Execution RCE...

CVE-2026-58138-Conductor-Unauth-RCE

CVE-2026-58138 — Conductor Unauthenticated RCE via INLINE GraalVM Evaluator Conductor OSS / Orkes3.21.21 … before 3.30.2 evaluates user-supplied JavaScript in INLINE and LAMBDA / DOWHILE / SWITCH tasks with a GraalVM context built with full host access HostAccess.ALL. The script reflects up to...

CVE-2026-109405

A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafkarequest.bootStrapServers resul...

CVE-2026-109403

A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the...

CVE-2026-109405

A security flaw in conductor-oss conductor (up to version 3.33.0-rc10 ) allows for Server-Side Request Forgery (SSRF) . The vulnerability exists in the KafkaPublishTask.start function located at kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. By manipulating ...

CVE-2026-109405 conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery

A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafkarequest.bootStrapServers resul...

CVE-2026-109402

A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side reques...

CVE-2026-109190

A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be...

CVE-2026-109404

A server-side request forgery (SSRF) vulnerability exists in conductor-oss conductor versions up to 3.33.0-rc10 . The flaw originates from an unspecified functionality within the AgentController.java file, specifically located in the Agentspan Agent Runtime component. This vulnerability allows fo...

CVE-2026-109403 conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery

A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the...

CVE-2026-109403

The conductor-oss conductor software (up to version 3.32.5 ) is vulnerable to Server-Side Request Forgery (SSRF) in the Agent Card Fetching component. The flaw exists within the A2AService.getAgentCard function located in the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java...

CVE-2026-109402

A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side reques...

CVE-2026-109402

A server-side request forgery (SSRF) vulnerability exists in conductor-oss conductor version 3.22.0 . The flaw is located within the MCP Service component, specifically in the MCPService.listTools function found in the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java. An at...

CVE-2026-109402 conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery

A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side reques...

CVE-2026-109190 conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery

A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be...