CVE-2026-109190

6.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

6.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: Limited impact
Weakness: CWE-918

Impact

Authenticated remote attackers can trigger Server-Side Request Forgery (SSRF) to make the server send unauthorized requests to internal network services. They need network access and valid low-privileged credentials.

Root cause

The ListApiToolsTask.start function in ListApiToolsTask.java improperly validates the user-supplied specUrl argument.

Affected systems

conductor-oss conductor 3.31.2

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Fix & remediation

A fixed release is not currently documented in the advisory; restrict outbound HTTP/HTTPS egress from the Conductor server to internal network ranges or block untrusted input to the API Tool Configuration component.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109190