CVE-2026-109404

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-918

Impact

Remote, unauthenticated attackers can trigger unauthorized internal HTTP requests via server-side request forgery (SSRF). This requires network access to the Conductor service endpoints.

Root cause

Improper input validation in AgentController.java within the Agentspan Agent Runtime allows external callers to manipulate outbound server requests.

Affected systems

conductor-oss conductor through 3.33.0-rc10

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade to a version past 3.33.0-rc10 once published, or restrict network access to the AgentController endpoints using a reverse proxy or firewall rules.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109404