CVE-2026-124507: conductor-oss conductor PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery
A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNERCONTEXTFETCH Task Handler. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The issue can be exploited remotely and requires no privileges or user interaction, according to the supplied severity vector. Exploitation involves manipulating the url argument handled by the PLANNER_CONTEXT_FETCH task.
Which releases are identified as affected?
The vulnerability is reported in conductor-oss conductor up to versions 3.32.4, 3.33.0, 3.34.0-rc3, and 4.0.0-alpha.1. The provided data does not identify a fixed release.
How urgent is remediation?
Public exploit information is available, and the severity vector marks exploit maturity as proof-of-concept. The reported impact is limited to confidentiality, but SSRF can allow requests from the affected server to attacker-selected destinations.