Description
A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| conductor-oss | conductor | 3.32.0, 3.32.1, 3.32.2, 3.32.3, 3.32.4, 3.32.5 | — |
References
- VDB-416945 | conductor-oss conductor Agent Card Fetching A2AService.java A2AService.getAgentCard server-side request forgery vdb-entry technical-description
- VDB-416945 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-109403 | CVE Analysis and Report third-party-advisory
- Submit #979791 | Conductor OSS Conductor >= 3.32.0 (3.31.2-3.32.0-rc.13 only with explicit opt-in) server-side request forgery (CWE-918) third-party-advisory