Conductor OSS EUVD-2026-98478

Exploitation requires that the Conductor 'Agent Card Fetching' feature (the A2A/agent-to-agent AI component, A2AService.getAgentCard) is deployed and its endpoint is reachable by the attacker, and that the attacker can control the 'agentUrl' argument passed to it. Per the CVSS vector this needs no authentication (PR:N) and no user interaction (UI:N) and is network-reachable (AV:N). Limiting factors: the AI/a2a agent-card functionality must actually be enabled and exposed - Conductor instances not using the A2A agent feature, or with the endpoint restricted to internal networks, are not realistically exploitable; impact is bounded to SSRF (coercing server-side requests) rather than direct code execution, and all CVSS impacts are rated Low.

Signals are moderate and largely consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which normally argues for priority; however, the vulnerable-system impacts are all rated Low (VC:L/VI:L/VA:L) and there is no subsequent-system (scope) impact (SC:N/SI:N/SA:N), yielding a 6.9 Medium - typical for an SSRF where the attacker can coerce outbound requests but does not directly achieve full read/write or code execution. The E:P flag indicates a proof-of-concept exploit exists (matching the 'publicly disclosed' language), but this is NOT CISA KEV and there is no evidence of active exploitation - publicly available exploit code exists, which is distinct from in-the-wild use. EPSS was NOT provided in the input, so probability-of-exploitation cannot be quantified here. The single reporting/reference source is VulDB (no independent vendor advisory linked), so affected-version and impact details are not vendor-confirmed. Net: a credible but Medium-severity SSRF - worth patching on a normal cadence, especially where Conductor is internet-exposed, but not an emergency absent KEV listing or higher confirmed impact.

A remote, unauthenticated attacker sends a request to the Agent Card Fetching endpoint with a manipulated 'agentUrl' value pointing at an internal address (e.g., cloud metadata service or an internal admin port). Conductor's A2AService.getAgentCard fetches that URL server-side, letting the attacker probe internal services or retrieve limited internal responses. A public proof-of-concept has been disclosed, lowering the skill needed to reproduce the attack.