CVE-2026-109402 in conductor
Prediction
by VulDB Data Team • 10/12/2026
A vulnerability was found in <a href="/product/conductor-oss:conductor">conductor-oss conductor 3.22.0</a>. Affected is the function <code>MCPService.listTools</code> of the file <em>ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java</em> of the component <em>MCP Service</em>. Performing a manipulation of the argument <em>mcpServer</em> results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.