CVE-2026-109402

A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side reques...

CVE-2026-109402

A server-side request forgery (SSRF) vulnerability exists in conductor-oss conductor version 3.22.0 . The flaw is located within the MCP Service component, specifically in the MCPService.listTools function found in the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java. An at...

CVE-2026-109402 conductor-oss conductor MCP Service MCPService.java MCPService.listTools server-side request forgery

A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side reques...

CVE-2026-109402

A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side reques...