CVE-2026-109402 | conductor-oss conductor 3.22.0 MCP Service MCPService.java MCPService.listTools mcpServer server-side request forgery

October 12, 2026 Yanac

A vulnerability identified as critical has been detected in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side request forgery.

This vulnerability was named CVE-2026-109402. The attack may be initiated remotely. In addition, an exploit is available.VulDB Recent EntriesRead More