Description
A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible.
Published: 2026-10-13
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Server-side request forgery
Action: Patch Now
AI Analysis

Impact

A Server Side Request Forgery vulnerability exists in the AgentController.java component of the Agentspan Agent Runtime within conductor-oss conductor up to version 3.33.0-rc10. The flaw allows a remote attacker to craft requests that cause the vulnerable server to perform arbitrary HTTP calls to internal or external services, effectively turning the server into an unintended client and potentially exposing resources that are normally inaccessible.

Affected Systems

The affected product is conductor-oss conductor. All releases up to and including 3.33.0-rc10 are vulnerable. Later releases are not indicated as affected by the current CVE record.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Remote exploitation is possible from any network-facing endpoint that hosts the AgentRuntime component. The attack likely proceeds via crafted HTTP requests sent to the vulnerable AgentController endpoint, forcing the server to reach resources that may otherwise be unreachable.

Generated by OpenCVE AI on October 13, 2026 at 13:50 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade conductor-oss conductor to a release newer than 3.33.0-rc10, which contains the fix for the SSRF issue.
  • Restrict network access to the Agentspan Agent Runtime service, allowing only trusted hosts or IP addresses to reach the vulnerable endpoint.
  • Implement outbound request filtering or a proxy that blocks internal IP ranges or specific protocols to mitigate SSRF risks.

Generated by OpenCVE AI on October 13, 2026 at 13:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 12:30:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible.
Title conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery
First Time appeared Conductor-oss
Conductor-oss conductor
Weaknesses CWE-918
CPEs cpe:2.3:a:conductor-oss:conductor:*:*:*:*:*:*:*:*
Vendors & Products Conductor-oss
Conductor-oss conductor
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Conductor-oss Conductor
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-13T13:02:42.671Z

Reserved: 2026-10-12T14:43:52.780Z

Link: CVE-2026-109404

cve-icon Vulnrichment

Updated: 2026-10-13T13:02:35.491Z

cve-icon NVD

Status : Deferred

Published: 2026-10-13T13:17:18.947

Modified: 2026-10-13T13:29:12.567

Link: CVE-2026-109404

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T14:00:09Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)