CVE-2026-109403: conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
conductor-oss conductor versions up to and including 3.32.5 are identified as affected. The vulnerable functionality is Agent Card Fetching in A2AService.getAgentCard.
What does an attacker need to exploit this issue?
The issue can be exploited remotely by manipulating the agentUrl argument. No privileges or user interaction are indicated by the provided severity vector.
Is public exploit information available?
Yes. The exploit has been publicly disclosed and may be used.
What impact can successful exploitation have?
Successful exploitation can cause server-side request forgery, causing the affected server to make requests chosen by an attacker. The supplied vector indicates low confidentiality, integrity, and availability impact.