CVE-2026-109190 | conductor-oss conductor 3.31.2 API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start specUrl server-side request forgery

October 12, 2026 Yanac

A vulnerability was found in conductor-oss conductor 3.31.2. It has been classified as critical. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery.

This vulnerability is uniquely identified as CVE-2026-109190. The attack is possible to be carried out remotely. Moreover, an exploit is present.

The vendor was contacted early about this disclosure but did not respond in any way.VulDB Recent EntriesRead More