HighVulnerability
CVE-2026-109403: conductor-oss conductor server-side request forgery in agent card fetching
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-109403
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
Summary
A vulnerability in conductor-oss conductor up to 3.32.5 affects the function A2AService.getAgentCard in ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java, within the Agent Card Fetching component. Manipulating the agentUrl argument can lead to server-side request forgery. The attack can be launched remotely, and a public exploit has been disclosed.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumWhen LLM Gateways Go Wrong: Findings from LiteLLMSimilar attack · Check Point Research
- InfoExploring Backdoor Vulnerabilities and Fairness Challenges in Generative Models: A SurveySimilar attack · ACM Digital Library (TOPS, DTRAP, CSUR)
- LowSmall AI Models Could Soon Self-Replicate on IoT Devices, Anthropic WarnsSimilar attack · SecurityWeek
- MediumCVE-2026-108940: Mistral.rs path traversal through calibration_apply save_cimatrix argumentSimilar attack · NVD/CVE Database
- MediumCVE-2026-108939: mistral.rs server-side request forgery in is_global_ip validationSimilar attack · NVD/CVE Database