CVE-2026-124507

A vulnerability was found in conductor-oss conductor up to 3.32.4/3.33.0/3.34.0-rc3/4.0.0-alpha.1. This issue affects the function WorkflowSystemTask.start of the file PlannerContextFetchTask.java of the component PLANNER_CONTEXT_FETCH Task Handler. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. The researcher claims to have submitted a GHSA on the repository of the project.

• CWE-918

• https://github.com/conductor-oss/conductor/
• https://github.com/conductor-oss/conductor/security/advisories/GHSA-cx7c-4mp7-rhcj
• https://vuldb.com/cve/CVE-2026-124507
• https://vuldb.com/submit/1035482
• https://vuldb.com/vuln/432811
• https://vuldb.com/vuln/432811/cti
• https://vuldb.com/submit/1035482

Published

Nov 9, 2026

Last Modified

Nov 12, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-124501A weakness has been identified in Tidelift moto up to 5.2.4.…7.3
• CVE-2026-124502A security vulnerability has been detected in yungifez Skuul…4.3
• CVE-2026-124503A vulnerability was identified in sooperset mcp-atlassian up…4.3
• CVE-2026-124504A vulnerability was detected in erupts erupt up to 2.3.0. Af…6.3
• CVE-2026-124505A flaw has been found in Dianping CAT 3.0.0/3.1.0/4.0-RC1. T…4.3
• CVE-2026-124506A vulnerability has been found in Dianping CAT 3.0.0/3.1.0/4…4.3
• CVE-2026-124508A vulnerability was determined in floci-io Floci up to 2.4.0…5.3
• CVE-2026-124509A vulnerability was identified in floci-io Floci up to 2.1.0…7.3
• CVE-2026-12451Use after free in DigitalCredentials in Google Chrome prior …8.3
• CVE-2026-12452Use after free in Downloads in Google Chrome on Android prio…8.8
• CVE-2026-12453Insufficient validation of untrusted input in Input in Googl…4.2
• CVE-2026-124536JSON::XS versions before 4.05 for Perl allow memory exhausti…