CVE-2026-109190 conductor-oss conductor API Tool Configuration ListApiToolsTask.java ListApiToolsTask.start server-side request forgery
Remote attackers can exploit a server-side request forgery vulnerability in the Conductor API Tool Configuration to access internal resources.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-109190?
CVE-2026-109190 is a medium-severity server-side request forgery vulnerability in conductor-oss conductor, published on 13 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been found in conductor-oss conductor 3.31.2. This affects the function ListApiToolsTask.start of the file ListApiToolsTask.java of the component API Tool Configuration. The manipulation of the argument specUrl leads to server-side request forgery. The attack is possible to be carried out remotely. The exploit has been disclosed to the public and may be used.
Weakness: CWE-918
Which versions are affected by CVE-2026-109190?
How do I fix CVE-2026-109190?
No fix has been published for CVE-2026-109190 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-109190 being exploited?
There is no known exploitation of CVE-2026-109190 in the wild and no public exploit code.
Sources
Also known as GHSA-q2hq-xqfr-hx4g.