EUVD-2026-98477
GHSA-36mx-2w99-hqwq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege Conductor user
-
ExploitSubmit crafted mcpServer argument to MCPService.listTools
-
ExecutionServer issues attacker-controlled outbound request
-
ImpactReach internal/metadata endpoints for recon or limited data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated low-privilege account (CVSS PR:L) with the ability to invoke the MCP Service's listTools operation and control the mcpServer argument in ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java; the vulnerable path is tied to Conductor's MCP (Model Context Protocol) integration, so instances not using or exposing the MCP Service feature are not reachable. Limiting factors: valid authentication is needed (not remote-unauthenticated), impact is scored low with no subsequent-system scope change, and only version 3.22.0 is named as affected in the input. |
| Impact | This is a low-priority issue despite being an SSRF (CWE-918), and the signals are largely consistent. The CVSS 4.0 base score is only 2.1, driven by PR:L (authenticated low-privilege attacker required) and low vulnerable-system impact across confidentiality, integrity, and availability (VC:L/VI:L/VA:L) with no subsequent-system impact (SC:N/SI:N/SA:N) - meaning no scope escalation to internal systems is credited, which is unusually conservative for SSRF where pivoting to internal services is the typical concern. The exploit maturity is E:P (Proof-of-Concept), and the description confirms public exploit code exists, but there is NO CISA KEV listing and NO EPSS score provided in the input, so there is no evidence of active or widespread exploitation - public PoC availability is a distinct signal from exploitation in the wild. The entire record originates from a single source (VulDB), with no vendor advisory, NVD enrichment, or independent corroboration, which materially lowers confidence. Net assessment: real but minor - a genuine SSRF requiring authentication with low technical impact as scored; not a drop-everything priority. |
| Exploit ScenarioDerived | An authenticated low-privilege user of a Conductor instance manipulates the mcpServer argument passed to MCPService.listTools, causing the Conductor server to issue an attacker-controlled outbound request (server-side request forgery). Public proof-of-concept exploit code exists, lowering the bar to reproduce. In practice this could be used to probe internal network services or metadata endpoints reachable from the Conductor host, though the CVSS scoring credits only low impact and no subsequent-system compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 13, 2026
Server-side request forgery (CWE-918) in the MCP Service of conductor-oss Conductor 3.22.0 lets an authenticated low-privilege user who can invoke the listTools operation supply a crafted mcpServer argument and cause the Conductor server to issue requests to attacker-chosen destinations. The impact is scored low (CVSS 4.0 base 2.1; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L) because authentication is required, the vulnerable path is only reachable when the MCP integration is enabled and exposed, and there is no scope change to downstream systems. Publicly available exploit code exists for this issue, but there is no confirmation of active exploitation, and no EPSS or CISA KEV data was provided.
RemediationAI
No vendor-released patch identified at time of analysis, and the available references (VulDB entries only) do not point to a fixed Conductor version, so operators should track the conductor-oss project for an update addressing MCPService.listTools and upgrade promptly once a patched release is published. Until then, apply targeted compensating controls: if the MCP Service feature is not required, disable the AI/MCP integration entirely (removes the attack surface, at the cost of losing MCP tool functionality); if it is required, restrict who can invoke MCP operations and control the mcpServer argument to trusted administrators rather than low-privilege users, since exploitation requires an authenticated account with that capability. Enforce outbound egress filtering and DNS resolution controls on the Conductor host so that requests to internal RFC1918 ranges, loopback, and link-local addresses such as 169.254.169.254 (cloud instance metadata) are blocked, accepting the trade-off that legitimate MCP servers hosted on internal networks will also need explicit allowlisting. Additionally, validate/allowlist MCP server endpoints at the application layer if configurable, enable logging and alerting on outbound requests originating from the MCP Service to detect probing, and monitor the VulDB advisory at https://vuldb.com/vuln/416944 for patch guidance. Note that publicly available exploit code exists, which lowers the effort needed for an authenticated attacker to attempt this SSRF against exposed MCP-enabled instances.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Conductor is a Java-based workflow orchestration platform, and its AI module implements a Model Context Protocol (MCP) client integration under ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java. The listTools function accepts an mcpServer argument that identifies the MCP server endpoint to query; because that value is used to construct an outbound HTTP/network request without adequate validation of the target host, scheme, or resolved address, the argument can be manipulated to point at arbitrary internal or link-local resources. This is the classic CWE-918 server-side request forgery pattern, where a server-side component becomes a proxy for the attacker toward resources the attacker cannot reach directly (for example internal services, admin interfaces, or cloud metadata endpoints). Affected component metadata (CPE cpe:2.3:a:conductor-oss:conductor:*:*:*:*:*:*:*:*) is version-wildcarded, but the input names only version 3.22.0 as affected, and the presence of the MCP Service feature is a prerequisite for reachability.
Know when Conductor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Remotely reachable but requires an authenticated low-privilege user controlling the mcpServer argument, so AV:N/AC:L/PR:L/UI:N; SSRF yields limited C/I/A impact without a credited scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
Unauthenticated remote code execution in Orkes Conductor (conductor-oss) versions 3.21.21 through 3.30.1 lets remote att
Netflix Titus uses Java Bean Validation (JSR 380) custom constraint validators. Rated critical severity (CVSS 9.8), this
Server-side request forgery in Conductor OSS through 3.33.0-rc10 lets remote attackers influence the kafka_request.bootS
Server-side request forgery in Conductor OSS through 3.32.5 allows unauthenticated remote attackers to force the server
Server-side request forgery in conductor-oss Conductor through 3.33.0-rc10 allows unauthenticated remote attackers to in
Server-side request forgery in conductor-oss Conductor 3.31.2 allows an authenticated low-privileged user to force the s
Exploit-DB