Description
A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Task Handler. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| conductor-oss | conductor | 3.0, 3.1, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7, 3.8, 3.9, 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21, 3.22, 3.23, 3.24, 3.25, 3.26, 3.27, 3.28, 3.29, 3.30, 3.31, 3.32, 3.32.0, 3.32.1, 3.32.2, 3.32.3, 3.32.4, 3.33.0, 3.34.0-rc1, 3.34.0-rc2, 3.34.0-rc3, 4.0.0-alpha.0, 4.0.0-alpha.1 | — |
References
- VDB-432811 | conductor-oss conductor PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery vdb-entry technical-description
- VDB-432811 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-124507 | CVE Analysis and Report third-party-advisory
- Submit #1035482 | conductor-oss Conductor up to v3.33.0-rc5 (unfixed as of 2026-09-18; latest stable v3.32.4); runtime proof at released tag v3.32.4, commit 088de237a185caaeb669035a6d75de65d36cab5a (2026-09-10) Server-Side Request Forgery with respon third-party-advisory
- https://github.com/conductor-oss/conductor/security/advisories/GHSA-cx7c-4mp7-rhcj broken-link
- https://github.com/conductor-oss/conductor/ product