PT-2026-111415 · Conductor Oss · Conductor
CVSS v2.0
6.5
Medium
| Vector | AV:N/AC:L/Au:S/C:P/I:P/A:P |
A vulnerability was found in conductor-oss conductor 3.22.0. Affected is the function MCPService.listTools of the file ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java of the component MCP Service. Performing a manipulation of the argument mcpServer results in server-side request forgery. The attack may be initiated remotely. The exploit has been made public and could be used.
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Conductor