CVE-2026-109405: conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery
A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafkarequest.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments of conductor-oss conductor up to version 3.33.0-rc10 are identified as affected. The vulnerable code is in the Kafka task implementation, specifically KafkaPublishTask.start.
What does an attacker need to exploit it?
The attack can be executed remotely and does not require privileges or user interaction according to the supplied severity vector. Exploitation involves controlling the kafka_request.bootStrapServers argument.
Is public exploit code available?
Yes. The supplied information states that an exploit has been publicly released and may be used in attacks.