A vulnerability was identified in conductor-oss conductor up to 3.33.0-rc10, affecting the Agentspan Agent Runtime's AgentController.java component. This issue allows for server-side request forgery (SSRF) attacks. The vulnerability can be exploited remotely, and defenders should assess exposure and prioritize verification of the affected version in their environment. The manipulation of the file leads to [truncated]
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely.
A vulnerability was found in conductor-oss conductor 3.22.0, specifically in the MCPService.listTools function of the MCPService.java file. This function is susceptible to server-side request forgery (SSRF) attacks when the mcpServer argument is manipulated. The attack can be initiated remotely, and a public exploit has been made available. Defenders responsible for conductor-oss conductor deployments sho [truncated]
A vulnerability in conductor-oss conductor 3.31.2's API Tool Configuration, specifically in ListApiToolsTask.java, allows for server-side request forgery (SSRF) via manipulation of the specUrl argument in ListApiToolsTask.start. This issue is remotely exploitable. The CVE record was published on 2026-10-13T11:30:18.246Z and has not been modified since then.
