CVE-2026-109403

7.3High

Published 13 Oct 2026 · NVD status: Deferred

7.3High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-918

The AI triage for this one isn't ready yet. Check back in a few minutes; the full NVD record is below in the meantime.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Ad · In-content banner

NVD description

A vulnerability was determined in conductor-oss conductor up to 3.32.5. Affected by this vulnerability is the function A2AService.getAgentCard of the file ai/src/main/java/org/conductoross/conductor/ai/a2a/A2AService.java of the component Agent Card Fetching. Executing a manipulation of the argument agentUrl can lead to server-side request forgery. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

References

https://vuldb.com/cve/CVE-2026-109403
https://vuldb.com/submit/979791
https://vuldb.com/vuln/416945
https://vuldb.com/vuln/416945/cti

Source: nvd.nist.gov/vuln/detail/CVE-2026-109403