CVE-2026-124507
MEDIUM
MEDIUM
Priority: 0.02
BB Relevance:
71/100
Published: 2026-11-09
Modified: 2026-11-12
First seen: 2026-11-09
Status: active
Attack Surface
Network
Low Complexity
No Auth
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
None
S:
X
AT:
None
VC:
Low
VI:
None
VA:
None
Description
A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Task Handler. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project.
Weakness Classification (1)
Affected Software (88)
| Vendor | Product | Version |
|---|---|---|
| conductor-oss | conductor | 3.0 |
| conductor-oss | conductor | 3.1 |
| conductor-oss | conductor | 3.2 |
| conductor-oss | conductor | 3.3 |
| conductor-oss | conductor | 3.4 |
| conductor-oss | conductor | 3.5 |
| conductor-oss | conductor | 3.6 |
| conductor-oss | conductor | 3.7 |
| conductor-oss | conductor | 3.8 |
| conductor-oss | conductor | 3.9 |
| conductor-oss | conductor | 3.10 |
| conductor-oss | conductor | 3.11 |
| conductor-oss | conductor | 3.12 |
| conductor-oss | conductor | 3.13 |
| conductor-oss | conductor | 3.14 |
| conductor-oss | conductor | 3.15 |
| conductor-oss | conductor | 3.16 |
| conductor-oss | conductor | 3.17 |
| conductor-oss | conductor | 3.18 |
| conductor-oss | conductor | 3.19 |
| conductor-oss | conductor | 3.20 |
| conductor-oss | conductor | 3.21 |
| conductor-oss | conductor | 3.22 |
| conductor-oss | conductor | 3.23 |
| conductor-oss | conductor | 3.24 |
| conductor-oss | conductor | 3.25 |
| conductor-oss | conductor | 3.26 |
| conductor-oss | conductor | 3.27 |
| conductor-oss | conductor | 3.28 |
| conductor-oss | conductor | 3.29 |
Showing 30 of 88 entries