---
id: CVE-2026-124507
title: >-
  conductor-oss conductor PLANNER_CONTEXT_FETCH Task
  PlannerContextFetchTask.java WorkflowSystemTask.start server-side request
  forgery
summary: >-
  A vulnerability was found in conductor-oss conductor up to
  3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function
  WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the
  component PLANNER_CONTEXT_FETCH T…
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-918
vendor: conductor-oss
product: conductor
affected:
  - conductor 3.0
  - conductor 3.1
  - conductor 3.2
  - conductor 3.3
  - conductor 3.4
  - conductor 3.5
  - conductor 3.6
  - conductor 3.7
  - conductor 3.8
  - conductor 3.9
  - conductor 3.10
  - conductor 3.11
  - conductor 3.12
  - conductor 3.13
  - conductor 3.14
  - conductor 3.15
  - conductor 3.16
  - conductor 3.17
  - conductor 3.18
  - conductor 3.19
  - conductor 3.20
  - conductor 3.21
  - conductor 3.22
  - conductor 3.23
  - conductor 3.24
  - conductor 3.25
  - conductor 3.26
  - conductor 3.27
  - conductor 3.28
  - conductor 3.29
  - conductor 3.30
  - conductor 3.31
  - conductor 3.32
  - conductor 3.32.0
  - conductor 3.32.1
  - conductor 3.32.2
  - conductor 3.32.3
  - conductor 3.32.4
  - conductor 3.33.0
  - conductor 3.34.0-rc1
  - conductor 3.34.0-rc2
  - conductor 3.34.0-rc3
  - conductor 4.0.0-alpha.0
  - conductor 4.0.0-alpha.1
published: '2026-11-09'
updated: '2026-11-09'
sourceUpdated: '2026-11-09T01:00:36.982Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-124507'
references:
  - url: 'https://vuldb.com/vuln/432811'
    label: >-
      VDB-432811 | conductor-oss conductor PLANNER_CONTEXT_FETCH Task
      PlannerContextFetchTask.java WorkflowSystemTask.start server-side request
      forgery
  - url: 'https://vuldb.com/vuln/432811/cti'
    label: 'VDB-432811 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-124507'
    label: CVE-2026-124507 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1035482'
    label: >-
      Submit #1035482 | conductor-oss Conductor up to v3.33.0-rc5 (unfixed as of
      2026-09-18; latest stable v3.32.4); runtime proof at released tag v3.32.4,
      commit 088de237a185caaeb669035a6d75de65d36cab5a (2026-09-10) Server-Side
      Request Forgery with response read-back
  - url: >-
      https://github.com/conductor-oss/conductor/security/advisories/GHSA-cx7c-4mp7-rhcj
  - url: 'https://github.com/conductor-oss/conductor/'
tags:
  - cve.org
ingestedAt: '2026-11-09T02:01:54.437Z'
---

## Overview

A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Task Handler. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project.

## Affected

- `conductor 3.0`
- `conductor 3.1`
- `conductor 3.2`
- `conductor 3.3`
- `conductor 3.4`
- `conductor 3.5`
- `conductor 3.6`
- `conductor 3.7`
- `conductor 3.8`
- `conductor 3.9`
- `conductor 3.10`
- `conductor 3.11`
- `conductor 3.12`
- `conductor 3.13`
- `conductor 3.14`
- `conductor 3.15`
- `conductor 3.16`
- `conductor 3.17`
- `conductor 3.18`
- `conductor 3.19`
- `conductor 3.20`
- `conductor 3.21`
- `conductor 3.22`
- `conductor 3.23`
- `conductor 3.24`
- `conductor 3.25`
- `conductor 3.26`
- `conductor 3.27`
- `conductor 3.28`
- `conductor 3.29`
- `conductor 3.30`
- `conductor 3.31`
- `conductor 3.32`
- `conductor 3.32.0`
- `conductor 3.32.1`
- `conductor 3.32.2`
- `conductor 3.32.3`
- `conductor 3.32.4`
- `conductor 3.33.0`
- `conductor 3.34.0-rc1`
- `conductor 3.34.0-rc2`
- `conductor 3.34.0-rc3`
- `conductor 4.0.0-alpha.0`
- `conductor 4.0.0-alpha.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.