CVEs in Conductor-OSS 3.32.0-rc.25
Author: peter-mcclonskiCreated Aug 12, 2026Updated Sep 9, 2026
Labelsdependencies
Thanks to the great work from the dev team, the CVE count has dropped markedly after #1490 got resolved! However, the following issues remain:
Vulnerabilities found for image myprivateregistry.org/conductoross/conductor:3.32.0-rc.25;: total - 12, critical - 1, high - 11, medium - 0, low - 0
Image: myprivateregistry.org/conductoross/conductor:3.32.0-rc.25;
Package: libssh2
Version: 1.11.1-1+deb13u1
Path: N/A
Status: open
Severity: high
CVE: ['CVE-2026-58050']
Description: ['CVE-2026-58050'] -
----------------------------------------
Image: myprivateregistry.org/conductoross/conductor:3.32.0-rc.25;
Package: nginx
Version: 1.26.3-3+deb13u7
Path: N/A
Status: open
Severity: high
CVE: ['CVE-2026-60005']
Description: ['CVE-2026-60005'] -
----------------------------------------
Image: myprivateregistry.org/conductoross/conductor:3.32.0-rc.25;
Package: io.netty_netty-codec-http2
Version: 4.1.135.Final
Path: /app/libs/conductor-server.jar/netty-codec-http2-4.1.135.Final.jar
Status: fixed in 4.2.16.Final, 4.1.136.Final
Severity: high
CVE: ['CVE-2026-56819']
Description: ['CVE-2026-56819'] -
----------------------------------------
Image: myprivateregistry.org/conductoross/conductor:3.32.0-rc.25;
Package: org.elasticsearch_elasticsearch
Version: 7.17.29
Path: /app/libs/conductor-server.jar/elasticsearch-7.17.29.jar
Status: fixed in 9.2.2, 9.1.8, 8.19.8,...
Severity: high
CVE: ['CVE-2025-37731']
Description: ['CVE-2025-37731'] - Improper Authentication in Elasticsearch PKI realm can lead to user impersonati
----------------------------------------
Image: myprivateregistry.org/conductoross/conductor:3.32.0-rc.25;
Package: io.micrometer_micrometer-core
Version: 1.15.11
Path: /app/libs/conductor-server.jar/micrometer-core-1.15.11.jar
Status: fixed in 1.16.6, 1.15.12
Severity: high
CVE: ['CVE-2026-40983', 'CVE-2026-40984']
Description: ['CVE-2026-40983'] -
['CVE-2026-40984'] -
----------------------------------------
Image: myprivateregistry.org/conductoross/conductor:3.32.0-rc.25;
Package: io.netty_netty-codec-http
Version: 4.1.135.Final
Path: /app/libs/conductor-server.jar/netty-codec-http-4.1.135.Final.jar
Status: fixed in 4.2.16.Final, 4.1.136.Final
Severity: high
CVE: ['CVE-2026-55831', 'CVE-2026-55833', 'CVE-2026-56745']
Description: ['CVE-2026-55831'] -
['CVE-2026-55833'] -
['CVE-2026-56745'] -
----------------------------------------
Image: myprivateregistry.org/conductoross/conductor:3.32.0-rc.25;
Package: io.netty_netty-codec
Version: 4.1.135.Final
Path: /app/libs/conductor-server.jar/netty-codec-4.1.135.Final.jar
Status: fixed in 4.1.136.Final
Severity: high
CVE: ['CVE-2026-59901']
Description: ['CVE-2026-59901'] -
----------------------------------------
Image: myprivateregistry.org/conductoross/conductor:3.32.0-rc.25;
Package: perl
Version: 5.40.1-6
Path: N/A
Status: open
Severity: critical
CVE: ['CVE-2026-13221', 'CVE-2026-57432']
Description: ['CVE-2026-13221'] -
['CVE-2026-57432'] -
----------------------------------------
Vulnerabilities found for image myprivateregistry.org/conductoross/conductor:3.32.0-rc.25;: total - 12, critical - 1, high - 11, medium - 0, low - 0Skimming this, it looks like the low hanging fruit is netty, micrometer, and elasticsearch. Knocking those out should result in a pretty solid state.
Additionally, two questions for the community:
- I noticed that the original cleanup made its way into 3.32.0-rc.25, but then it looks like rc.25 got yanked and the fixes are not present in the resulting 3.32.0. Is there an estimate of when a release will be cut with the security cleanups?
- Skimming the remaining vulnerabilities, are perl and libssh2 actually required for the functioning of the image? Could these be resolved with a lighter base image? Or, from your expertise, is there a reason not to just remove them in a post-release customization patch on our end?
Source: conductor-oss/conductor