CVE-2026-124507 in conductor
Prediction
by VulDB Data Team • 11/08/2026
A vulnerability was found in <a href="/product/conductor-oss:conductor">conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1</a>. This issue affects the function <code>WorkflowSystemTask.start</code> of the file <em>PlannerContextFetchTask.java</em> of the component <em>PLANNER_CONTEXT_FETCH Task Handler</em>. The manipulation of the argument <em>url</em> results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project.
If you want to get best quality of vulnerability data, you may have to visit VulDB.