conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1 PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start url server-side request forgery

Summaryinfo

A vulnerability, which was classified as problematic, has been found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. Impacted is the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Task Handler. This manipulation of the argument url causes server-side request forgery. This vulnerability is handled as CVE-2026-124507. The attack can be initiated remotely. Additionally, an exploit exists. The researcher claims to have submitted a GHSA on the repository of the project.

Detailsinfo

A vulnerability classified as problematic was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. Affected by this vulnerability is the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Task Handler. The manipulation of the argument url with an unknown input leads to a server-side request forgery vulnerability. The CWE definition for the vulnerability is CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. As an impact it is known to affect confidentiality.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-124507. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known.

It is declared as proof-of-concept. The researcher claims to have submitted a GHSA on the repository of the project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• conductor-oss

Name

• conductor

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5
• 3.6
• 3.7
• 3.8
• 3.9
• 3.10
• 3.11
• 3.12
• 3.13
• 3.14
• 3.15
• 3.16
• 3.17
• 3.18
• 3.19
• 3.20
• 3.21
• 3.22
• 3.23
• 3.24
• 3.25
• 3.26
• 3.27
• 3.28
• 3.29
• 3.30
• 3.31
• 3.32
• 3.32.0
• 3.32.1
• 3.32.2
• 3.32.3
• 3.32.4
• 3.33.0
• 3.34.0-rc1
• 3.34.0-rc2
• 3.34.0-rc3
• 4.0.0-alpha.0
• 4.0.0-alpha.1

Website

• Product: https://github.com/conductor-oss/conductor/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #1035482: conductor-oss Conductor up to v3.33.0-rc5 (unfixed as of 2026-09-18; latest stable v3.32.4); runtime proof at released tag v3.32.4, commit 088de237a185caaeb669035a6d75de65d36cab5a (2026-09-10) Server-Side Request Forgery with response read-back (by lucasg2g)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion