CVE-2026-109404

A server-side request forgery (SSRF) vulnerability exists in conductor-oss conductor versions up to 3.33.0-rc10 . The flaw originates from an unspecified functionality within the AgentController.java file, specifically located in the Agentspan Agent Runtime component. This vulnerability allows fo...

CVE-2026-109404: Server-Side Request Forgery (SSRF)

A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10. Affected by this issue is some unknown functionality of the file AgentController.java of the component Agentspan Agent Runtime. The manipulation leads to server-side request forgery. Remote exploitation of the attack is...

com.maheshyaddanapudi:spring-boot-starter-conductor (>=3.21.11, <=3.21.11.2), org.conductoross:conductor-agentspan (3.4.0) +43 more potentially affected by CVE-2025-26074 via org.conductoross:conductor-core (>=3.3.0.rc2, <=3.21.12)

org.conductoross:conductor-core MAVEN version =3.3.0.rc2, =3.21.11, =3.3.0.rc2, =3.3.0.rc2, =3.3.0.rc2, =3.3.0.rc2, =3.3.0.rc2, =3.3.0.rc2, =3.3.0.rc2, =3.16.0, =3.3.0.rc2, =3.3.0.rc2, =3.3.0.rc2, =3.21.12 and more Source cves: CVE-2025-26074 Source advisory: OSV:GHSA-8GQP-HR9G-PG62...