Conductor OSS CVE-2026-109404

The flaw resides in AgentController.java within the Agentspan Agent Runtime component of conductor-oss Conductor (versions up to and including 3.33.0-rc10). Per the CVSS vector (PR:N/UI:N/AC:L/AT:N), exploitation requires no authentication, no user interaction, and no special attack prerequisites - the attacker needs only network reachability to the Agent Runtime endpoint that processes the attacker-supplied URL. The primary LIMITING factor is exposure: impact is confined to limited confidentiality (VC:L, no integrity/availability effect), so realistic risk depends on whether the Conductor instance is internet-facing versus isolated, and on what internal services or metadata endpoints are reachable from the server. The exact feature/parameter that accepts the forged URL is not detailed in the description.

This is a moderate-risk, not a top-priority, issue. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity, unauthenticated server-side request forgery, which raises baseline concern, but the impact metrics are narrow: only VC:L (limited confidentiality) with no integrity, availability, or subsequent-system impact, yielding a 6.9 (Medium) score. The vector carries E:P (Proof-of-Concept exploit maturity), indicating a demonstration-level exploit rather than confirmed active exploitation. No EPSS score was provided in the input, so real-world exploitation probability cannot be quantified. This CVE is NOT in CISA KEV, and no evidence of active exploitation exists. Signals are broadly consistent (network-reachable, no auth, limited impact), but note the single-source nature: all intelligence traces to VulDB only, with no vendor advisory, NVD enrichment, or independent confirmation, which lowers confidence in the affected-version range and the precise exploitability. Treat as a routine SSRF to patch during normal cycles, elevated only if the Conductor instance is internet-exposed and fronts sensitive internal metadata/services.

A remote, unauthenticated attacker sends a crafted request to the Agentspan Agent Runtime endpoint handled by AgentController.java, supplying an attacker-controlled URL that the server dereferences on its behalf. This SSRF can be used to reach internal-only services or read limited internal responses (consistent with VC:L). The CVSS 4.0 vector flags E:P, indicating a proof-of-concept exploit exists, though no weaponized or in-the-wild use is confirmed.