CVE-2026-109403 in conductor
Prediction
by VulDB Data Team • 10/12/2026
A vulnerability was determined in <a href="/product/conductor-oss:conductor">conductor-oss conductor up to 3.32.5</a>. Affected by this vulnerability is the function <code>A2AService.getAgentCard</code> of the file <em>ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java</em> of the component <em>Agent Card Fetching</em>. Executing a manipulation of the argument <em>agentUrl</em> can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.