CVE-2026-109190: conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery
A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker who can manipulate the specUrl argument used by the API Tool Configuration component can exploit it. The provided data does not state what authentication or application role is required to reach that functionality.
What is the practical impact of successful exploitation?
Successful exploitation allows server-side request forgery, meaning the affected server can be induced to make requests chosen by the attacker. The supplied severity vector indicates low confidentiality, integrity, and availability impact.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.