GHSA-cx7c-4mp7-rhcj: conductor-oss conductor PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery

Q: What access does an attacker need to exploit this issue?

The issue can be exploited remotely and does not require authentication or user interaction. An attacker must be able to influence the url argument handled by the PLANNER_CONTEXT_FETCH task handler.

Q: Which releases are reported as affected?

The vulnerability is reported in conductor-oss conductor up to versions 3.32.4, 3.33.0, 3.34.0-rc3, and 4.0.0-alpha.1. The provided data does not identify fixed releases.

Q: Is public exploit information available?

Yes. The exploit has been made public and could be used, increasing the likelihood of exploitation attempts.

Published Nov 9, 2026

Updated

A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNERCONTEXTFETCH Task Handler. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project.

Affected Software

1 affected component

conductor-oss conductor<=3.32.4, <=3.33.0, <=3.34.0-rc3, <=4.0.0-alpha.1

Event History

Nov 9, 2026

CVE Published

via OSV·01:00 AM

Data Sourced

via OSV·01:00 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The issue can be exploited remotely and does not require authentication or user interaction. An attacker must be able to influence the url argument handled by the PLANNER_CONTEXT_FETCH task handler.

Which releases are reported as affected?

The vulnerability is reported in conductor-oss conductor up to versions 3.32.4, 3.33.0, 3.34.0-rc3, and 4.0.0-alpha.1. The provided data does not identify fixed releases.

Is public exploit information available?

Yes. The exploit has been made public and could be used, increasing the likelihood of exploitation attempts.

GHSA-cx7c-4mp7-rhcj: conductor-oss conductor PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery

Affected Software

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which releases are reported as affected?

Is public exploit information available?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

Which releases are reported as affected?

Is public exploit information available?