Conductor
Monthly
Unauthenticated remote code execution in Orkes Conductor (conductor-oss) versions 3.21.21 through 3.30.1 lets remote attackers run arbitrary OS commands by POSTing inline workflow definitions to the workflow API before any authentication check. The flaw stems from GraalVM script evaluators left in an unsandboxed state (HostAccess.ALL / allowAllAccess(true)), allowing JavaScript or Python expressions in INLINE, LAMBDA, DO_WHILE, and SWITCH tasks to reach Java reflection and subprocess APIs. Reported by VulnCheck; no public exploit identified at time of analysis, though a detailed vendor/researcher advisory exists.
Server-side request forgery in Conductor OSS through 3.33.0-rc10 lets remote attackers influence the kafka_request.bootStrapServers argument handled by KafkaPublishTask.start in the Kafka contrib module, causing the Conductor server to connect to an attacker-chosen Kafka bootstrap endpoint. The issue is CWE-918; VulDB rates it CVSS 4.0 5.5, while our independent assessment uses CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:L/I:L/A:L and characterizes the practical impact as low, with publicly available exploit code existing but CISA KEV active exploitation not indicated in the provided data. Although the CVSS vector is PR:N, practical exploitation requires that the Kafka contrib module is deployed, that a usable KafkaPublishTask exists, and that the attacker can create or execute a workflow/task controlling the bootstrap-servers argument, so deployments that enforce authentication/authorization on workflow submission or are not internet-exposed are substantially less exposed.
Server-side request forgery in conductor-oss Conductor through 3.33.0-rc10 allows unauthenticated remote attackers to induce the Agentspan Agent Runtime to make crafted requests to arbitrary URLs via AgentController.java (CWE-918). The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) limits impact to confidentiality only, and the CVSS 4.0 vector's E:P metric indicates publicly available exploit code exists; no CISA KEV listing or confirmed active exploitation was provided. Realistic risk is moderate and hinges on whether the Conductor instance is internet-facing and what internal services or cloud metadata endpoints are reachable from the server.
Server-side request forgery in Conductor OSS through 3.32.5 allows unauthenticated remote attackers to force the server to fetch attacker-controlled URLs through the A2A Agent Card Fetching endpoint when the AI/a2a feature is enabled and reachable. The vulnerable path is A2AService.getAgentCard, where the agentUrl argument can be manipulated to reach internal services; publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is indicated. The independent assessment rates this as moderate with low confidentiality, integrity, and availability impact, and exploitation is realistic only where the A2A agent-card functionality is exposed.
Server-side request forgery (CWE-918) in the MCP Service of conductor-oss Conductor 3.22.0 lets an authenticated low-privilege user who can invoke the listTools operation supply a crafted mcpServer argument and cause the Conductor server to issue requests to attacker-chosen destinations. The impact is scored low (CVSS 4.0 base 2.1; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) because authentication is required, the vulnerable path is only reachable when the MCP integration is enabled and exposed, and there is no scope change to downstream systems. Publicly available exploit code exists for this issue, but there is no confirmation of active exploitation, and no EPSS or CISA KEV data was provided.
Server-side request forgery in conductor-oss Conductor 3.31.2 allows an authenticated low-privileged user to force the server to issue outbound HTTP requests to attacker-chosen destinations by supplying a crafted specUrl when defining an API tool, since ListApiToolsTask.start processes that argument without validating or restricting the target address. Successful abuse can expose internal-only services, loopback interfaces, and cloud instance metadata reachable from the Conductor host, with the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:N/C:L/I:L/A:N) reflecting limited confidentiality and integrity impact and no availability effect. Publicly available exploit code exists and the flaw is disclosed via VulDB; there is no indication of confirmed active exploitation (not in CISA KEV), and exploitation requires a valid low-privileged account that can create or modify API tool definitions plus a network position where internal targets are actually reachable.
Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Unauthenticated remote code execution in Orkes Conductor (conductor-oss) versions 3.21.21 through 3.30.1 lets remote attackers run arbitrary OS commands by POSTing inline workflow definitions to the workflow API before any authentication check. The flaw stems from GraalVM script evaluators left in an unsandboxed state (HostAccess.ALL / allowAllAccess(true)), allowing JavaScript or Python expressions in INLINE, LAMBDA, DO_WHILE, and SWITCH tasks to reach Java reflection and subprocess APIs. Reported by VulnCheck; no public exploit identified at time of analysis, though a detailed vendor/researcher advisory exists.
Server-side request forgery in Conductor OSS through 3.33.0-rc10 lets remote attackers influence the kafka_request.bootStrapServers argument handled by KafkaPublishTask.start in the Kafka contrib module, causing the Conductor server to connect to an attacker-chosen Kafka bootstrap endpoint. The issue is CWE-918; VulDB rates it CVSS 4.0 5.5, while our independent assessment uses CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:N/C:L/I:L/A:L and characterizes the practical impact as low, with publicly available exploit code existing but CISA KEV active exploitation not indicated in the provided data. Although the CVSS vector is PR:N, practical exploitation requires that the Kafka contrib module is deployed, that a usable KafkaPublishTask exists, and that the attacker can create or execute a workflow/task controlling the bootstrap-servers argument, so deployments that enforce authentication/authorization on workflow submission or are not internet-exposed are substantially less exposed.
Server-side request forgery in conductor-oss Conductor through 3.33.0-rc10 allows unauthenticated remote attackers to induce the Agentspan Agent Runtime to make crafted requests to arbitrary URLs via AgentController.java (CWE-918). The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) limits impact to confidentiality only, and the CVSS 4.0 vector's E:P metric indicates publicly available exploit code exists; no CISA KEV listing or confirmed active exploitation was provided. Realistic risk is moderate and hinges on whether the Conductor instance is internet-facing and what internal services or cloud metadata endpoints are reachable from the server.
Server-side request forgery in Conductor OSS through 3.32.5 allows unauthenticated remote attackers to force the server to fetch attacker-controlled URLs through the A2A Agent Card Fetching endpoint when the AI/a2a feature is enabled and reachable. The vulnerable path is A2AService.getAgentCard, where the agentUrl argument can be manipulated to reach internal services; publicly available exploit code exists, but no confirmed active exploitation (CISA KEV) is indicated. The independent assessment rates this as moderate with low confidentiality, integrity, and availability impact, and exploitation is realistic only where the A2A agent-card functionality is exposed.
Server-side request forgery (CWE-918) in the MCP Service of conductor-oss Conductor 3.22.0 lets an authenticated low-privilege user who can invoke the listTools operation supply a crafted mcpServer argument and cause the Conductor server to issue requests to attacker-chosen destinations. The impact is scored low (CVSS 4.0 base 2.1; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) because authentication is required, the vulnerable path is only reachable when the MCP integration is enabled and exposed, and there is no scope change to downstream systems. Publicly available exploit code exists for this issue, but there is no confirmation of active exploitation, and no EPSS or CISA KEV data was provided.
Server-side request forgery in conductor-oss Conductor 3.31.2 allows an authenticated low-privileged user to force the server to issue outbound HTTP requests to attacker-chosen destinations by supplying a crafted specUrl when defining an API tool, since ListApiToolsTask.start processes that argument without validating or restricting the target address. Successful abuse can expose internal-only services, loopback interfaces, and cloud instance metadata reachable from the Conductor host, with the assessed CVSS:3.1 vector (AV:N/AC:L/PR:L/UI:N/S:N/C:L/I:L/A:N) reflecting limited confidentiality and integrity impact and no availability effect. Publicly available exploit code exists and the flaw is disclosed via VulDB; there is no indication of confirmed active exploitation (not in CISA KEV), and exploitation requires a valid low-privileged account that can create or modify API tool definitions plus a network position where internal targets are actually reachable.
Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.