CVE-2026-109404: Server-Side Request Forgery in conductor-oss conductor

This vulnerability in conductor-oss conductor up to version 3.33.0-rc10 involves server-side request forgery via manipulation of functionality in the AgentController.java file of the Agentspan Agent Runtime component. Remote attackers can exploit this flaw to induce the server to send crafted requests to unintended destinations. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, with partial impact on confidentiality but no impact on integrity or availability.

Successful exploitation allows remote attackers to perform server-side request forgery, potentially enabling them to make unauthorized requests from the affected server. This could lead to information disclosure or interaction with internal systems not directly accessible to the attacker. However, the impact is limited to confidentiality with no direct integrity or availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or fix information is provided in the available data. Until a fix is available, consider restricting network access and validating inputs related to the affected component to reduce exposure.