medium6.3
CVE-2026-109402
A vulnerability was found in conductor-oss conductor 3.22.0.
Impact
A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used.
Affected packages
This record carries no package version data, so it cannot be matched against a dependency list automatically. Read the advisory and compare your version by hand.