high7.3
CVE-2026-109403
A vulnerability was determined in conductor-oss conductor up to 3.32.5.
Impact
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected products
| Product | Affected versions |
|---|---|
| Conductor-Oss Conductor | before 3.32.5. |
Versions were read from the advisory text. No structured product data has been published for this record yet.