The vulnerability resides in the ListApiToolsTask.start method of the API Tool Configuration component of conductor-oss conductor. By crafting the specUrl argument, an attacker can cause the server to send HTTP requests to arbitrary URLs, a classic server‑side request forgery that can expose internal resources or exfiltrate data. The flaw is exploitable remotely and a publicly disclosed exploit indicates that threat actors could trigger internal data disclosure via SSRF if they can reach the affected endpoint.

The affected product is conductor‑oss conductor, version 3.31.2. No other affected versions are listed in the advisory.

The CVSS base score of 5.3 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. However the remote nature of the flaw, the public disclosure of an exploit, and the lack of privileged access requirements mean that attackers can trigger internal data exposure by sending malicious requests to the exposed API endpoint.