CVE-2026-109405

A security flaw in conductor-oss conductor (up to version 3.33.0-rc10 ) allows for Server-Side Request Forgery (SSRF) . The vulnerability exists in the KafkaPublishTask.start function located at kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. By manipulating ...

CVE-2026-109404

A server-side request forgery (SSRF) vulnerability exists in conductor-oss conductor versions up to 3.33.0-rc10 . The flaw originates from an unspecified functionality within the AgentController.java file, specifically located in the Agentspan Agent Runtime component. This vulnerability allows fo...

CVE-2026-109403

The conductor-oss conductor software (up to version 3.32.5 ) is vulnerable to Server-Side Request Forgery (SSRF) in the Agent Card Fetching component. The flaw exists within the A2AService.getAgentCard function located in the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java...

CVE-2026-109402

A server-side request forgery (SSRF) vulnerability exists in conductor-oss conductor version 3.22.0 . The flaw is located within the MCP Service component, specifically in the MCPService.listTools function found in the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java. An at...

CVE-2026-109190

A server-side request forgery (SSRF) vulnerability exists in conductor-oss conductor version 3.31.2 . The flaw is located within the API Tool Configuration component, specifically affecting the ListApiToolsTask.start function in the ListApiToolsTask.java file. An attacker can trigger the SSRF rem...