CVE-2026-109403: Server-Side Request Forgery in conductor-oss conductor

This vulnerability affects the conductor-oss conductor software up to version 3.32.5 in the Agent Card Fetching component, specifically the A2AService.getAgentCard function. An attacker can manipulate the agentUrl parameter to perform server-side request forgery, potentially causing the server to make unintended requests. The vulnerability is remotely exploitable and has been publicly disclosed, but there are no known exploits in the wild at this time.

Successful exploitation allows an attacker to cause the server to make arbitrary requests to internal or external systems, which may lead to information disclosure or interaction with internal services. The CVSS score of 6.9 reflects a medium severity impact with network attack vector, no privileges required, and no user interaction needed.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid exposing the vulnerable function to untrusted inputs or implement input validation and filtering on the agentUrl parameter to mitigate SSRF risk.