CVE-2026-124507: 
Chainguard Analyse et atténuation de la vulnérabilité

CVE-2026-124507 is a Server-Side Request Forgery (SSRF) vulnerability in the PLANNER_CONTEXT_FETCH Task Handler of conductor-oss Conductor, an open-source workflow orchestration engine. The flaw resides in the WorkflowSystemTask.start function within PlannerContextFetchTask.java, where the url argument is not properly validated, allowing a remote attacker to manipulate server-side HTTP requests. Affected versions span the entire 3.x release line through 3.32.4/3.33.0/3.34.0-rc3, as well as pre-release 4.0.0-alpha.0 and 4.0.0-alpha.1. The vulnerability was published on November 9, 2026, with a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.5 (Medium) (Github Advisory, VulDB).

The root cause is insufficient input validation of the url parameter in the PLANNER_CONTEXT_FETCH task handler, classified as CWE-918 (Server-Side Request Forgery). When a workflow task of type PLANNER_CONTEXT_FETCH is executed, the WorkflowSystemTask.start method in PlannerContextFetchTask.java uses the attacker-supplied url value to make an outbound HTTP request without validating the destination. Because no authentication is required to submit workflow tasks in default configurations, an unauthenticated remote attacker can craft a workflow definition or task input that causes the Conductor server to issue requests to arbitrary internal or external endpoints (Github Advisory, VulDB).

Successful exploitation allows an unauthenticated attacker to make the Conductor server perform HTTP requests to arbitrary destinations, including internal network resources, cloud metadata services (e.g., http://169.254.169.254), and other services accessible from the server's network context. The primary impact is a partial confidentiality breach — sensitive internal data such as cloud credentials, internal API responses, or configuration details could be exfiltrated. Integrity and availability of the Conductor server itself are not directly impacted, but the SSRF could serve as a pivot point for further lateral movement within internal networks (Github Advisory, Feedly).

A proof-of-concept exploit has been made public according to the vulnerability description, though no specific PoC repository or exploit kit has been identified in available sources (Github Advisory). The CVSS v4.0 exploit maturity is rated PROOF_OF_CONCEPT. The EPSS score is 0.0, indicating a currently low probability of widespread exploitation. There is no evidence of active in-the-wild exploitation, no threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of publication (VulDB).

1. Reconnaissance: Identify publicly accessible Conductor server instances (versions ≤ 3.32.4, 3.33.0, 3.34.0-rc3, or 4.0.0-alpha.1) using tools like Shodan or Censys, searching for the Conductor API port (default 8080).
2. Craft malicious workflow task: Construct a workflow definition or task input containing a PLANNER_CONTEXT_FETCH task type with the url parameter set to a target internal address (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata, or an internal service URL).
3. Submit the workflow: Send the crafted workflow definition or task execution request to the Conductor API endpoint (e.g., POST /api/workflow) without requiring authentication in default configurations.
4. Retrieve results: Monitor the workflow execution output or task result, which will contain the HTTP response body from the internally-fetched URL, potentially exposing sensitive data such as cloud credentials or internal service responses (Github Advisory, VulDB).

• Network: Outbound HTTP requests from the Conductor server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254, fd00:ec2::254); unexpected connections to non-standard internal services initiated by the Conductor process.
• Logs: Conductor application logs showing PLANNER_CONTEXT_FETCH task executions with unusual or internal url parameter values; HTTP client logs recording requests to internal endpoints or metadata services.
• Workflow Definitions: Presence of workflow definitions containing PLANNER_CONTEXT_FETCH tasks with url values pointing to internal network addresses, metadata services, or localhost.

Upgrade conductor-oss Conductor to a version beyond 4.0.0-alpha.1 that includes a patch for this vulnerability; consult the GitHub Security Advisory GHSA-cx7c-4mp7-rhcj for the specific fixed release once confirmed (Github Advisory). As an interim workaround, implement strict input validation and allowlist-based URL filtering for all url parameters in workflow task definitions. Additionally, restrict outbound network access from the Conductor service using firewall rules or network policies to block requests to internal IP ranges and cloud metadata endpoints, and apply the principle of least privilege to the Conductor service's network permissions.