{"affected":[{"product":"conductor","source":"CNA: VulDB","vendor":"conductor-oss","versions":[{"status":"affected","version":"3.0"},{"status":"affected","version":"3.1"},{"status":"affected","version":"3.2"},{"status":"affected","version":"3.3"},{"status":"affected","version":"3.4"},{"status":"affected","version":"3.5"},{"status":"affected","version":"3.6"},{"status":"affected","version":"3.7"},{"status":"affected","version":"3.8"},{"status":"affected","version":"3.9"},{"status":"affected","version":"3.10"},{"status":"affected","version":"3.11"},{"status":"affected","version":"3.12"},{"status":"affected","version":"3.13"},{"status":"affected","version":"3.14"},{"status":"affected","version":"3.15"},{"status":"affected","version":"3.16"},{"status":"affected","version":"3.17"},{"status":"affected","version":"3.18"},{"status":"affected","version":"3.19"},{"status":"affected","version":"3.20"},{"status":"affected","version":"3.21"},{"status":"affected","version":"3.22"},{"status":"affected","version":"3.23"},{"status":"affected","version":"3.24"},{"status":"affected","version":"3.25"},{"status":"affected","version":"3.26"},{"status":"affected","version":"3.27"},{"status":"affected","version":"3.28"},{"status":"affected","version":"3.29"},{"status":"affected","version":"3.30"},{"status":"affected","version":"3.31"},{"status":"affected","version":"3.32"},{"status":"affected","version":"3.32.0"},{"status":"affected","version":"3.32.1"},{"status":"affected","version":"3.32.2"},{"status":"affected","version":"3.32.3"},{"status":"affected","version":"3.32.4"},{"status":"affected","version":"3.33.0"},{"status":"affected","version":"3.34.0-rc1"},{"status":"affected","version":"3.34.0-rc2"},{"status":"affected","version":"3.34.0-rc3"},{"status":"affected","version":"4.0.0-alpha.0"},{"status":"affected","version":"4.0.0-alpha.1"}]}],"cveId":"CVE-2026-124507","cwes":["CWE-918"],"description":"A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Task Handler. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: VulDB","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"},{"score":5.3,"severity":"medium","source":"CNA: VulDB","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C","version":"3.1"},{"score":5.3,"severity":"medium","source":"CNA: VulDB","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C","version":"3.0"},{"score":5,"severity":"medium","source":"CNA: VulDB","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N/E:POC/RL:ND/RC:C","version":"2.0"}],"modifiedAt":1794186036982,"publishedAt":1794186036982,"references":[{"source":"CNA: VulDB","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/vuln/432811"},{"source":"CNA: VulDB","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/432811/cti"},{"source":"CNA: VulDB","tags":["third-party-advisory"],"url":"https://vuldb.com/cve/CVE-2026-124507"},{"source":"CNA: VulDB","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/1035482"},{"source":"CNA: VulDB","tags":["broken-link"],"url":"https://github.com/conductor-oss/conductor/security/advisories/GHSA-cx7c-4mp7-rhcj"},{"source":"CNA: VulDB","tags":["product"],"url":"https://github.com/conductor-oss/conductor/"}],"remediation":[],"revision":"04fcf53ecd80b4ad20d1cafe712a7e970746f98a09bcf09b7be8ca70d5faeac6","sources":[{"modifiedAt":1794186036982,"name":"CNA: VulDB","retrievedAt":1794190104046,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124507"}],"ssvc":null,"status":"published","title":"conductor-oss conductor PLANNER_CONTEXT_FETCH Task PlannerContextFetchTask.java WorkflowSystemTask.start server-side request forgery","updatedAt":1794190104046}