CVE-2026-109404: conductor-oss conductor Agentspan Agent Runtime AgentController.java server-side request forgery
A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible.
Affected Software
Event History
Frequently Asked Questions
Which deployments should be considered exposed?
Deployments of conductor-oss conductor using a version up to 3.33.0-rc10 should be considered potentially affected. The issue is associated with unknown functionality in AgentController.java within the Agentspan Agent Runtime component.
Does exploitation require authentication or user interaction?
No authentication or user interaction is required according to the supplied vector. Exploitation can be performed remotely with low attack complexity.
What could an attacker gain through this issue?
The stated impact is limited to confidentiality. The provided data does not identify which internal resources could be requested or what information could be exposed.