Server-Side Request Forgery in Conductor OSS by Conductor
CVE-2026-109402

5.3MEDIUM

Key Information:

Vendor

Conductor-oss

Status
Conductor
Vendor
CVE Published:
13 October 2026

What is CVE-2026-109402?

A security flaw has been identified in Conductor OSS version 3.22.0 due to the design of the MCPService.listTools function. By manipulating the mcpServer argument within the MCP Service component, an attacker can conduct server-side request forgery (SSRF) attacks. This vulnerability allows remote exploitation, potentially enabling attackers to send unauthorized requests from the server, thus compromising its integrity. The information regarding this exploit has been publicly disclosed, emphasizing the need for immediate action to mitigate risks associated with this vulnerability.

Affected Version(s)

conductor 3.22.0

References

https://vuldb.com/vuln/416944
vdb-entrytechnical-description
https://vuldb.com/vuln/416944/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-109402
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

lucasg2g (VulDB User)
VulDB Vulnerability Moderation Team
.