GHSA-gq4w-px3f-vc47MediumCVSS 5.3
A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1...
🔗 CVE IDs covered (1)
📋 Description
A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Task Handler. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project.
🔗 References (8)
- https://github.com/conductor-oss/conductor/security/advisories/GHSA-cx7c-4mp7-rhcj
- https://nvd.nist.gov/vuln/detail/CVE-2026-124507
- https://github.com/conductor-oss/conductor
- https://vuldb.com/cve/CVE-2026-124507
- https://vuldb.com/submit/1035482
- https://vuldb.com/vuln/432811
- https://vuldb.com/vuln/432811/cti
- https://github.com/advisories/GHSA-gq4w-px3f-vc47