conductor vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

CO

Product

conductor

by conductor-oss · last CVE Oct 13, 2026

6

CVEs

0

On KEV

9.8

Max CVSS

5

New 30D

Vulnerabilities6 In the news1 Timeline

Severity mix

Critical 1High 2Medium 3Low 0

Severity

All severities6 Critical1 High2 Medium3 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add conductor to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-58138	9.8	9%	Jun 30	Orkes Conductor 3.21.21 < 3.30.2 Unauthenticated RCE via GraalVM Script Evaluators Affected: 3.21.21 before 3.30.2
CVE-2026-109405	7.3	0%	Oct 13	conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery Affected: 3.33.0-rc10
CVE-2026-109403	7.3	0%	Oct 13	conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery Affected: 3.32.0; 3.32.1; 3.32.2; 3.32.3; 3.32.4; 3.32.5
CVE-2026-109402	6.3	0%	Oct 13	conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery Affected: 3.22.0
CVE-2026-109190	6.3	0%	Oct 13	conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery Affected: 3.31.2
CVE-2026-109404	5.3	0%	Oct 13	conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery Affected: 3.33.0-rc10