Vulnerability · Published Oct 13, 2026 · Assigned by VulDB

CVE-2026-109405conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery

High 7.3

In plain English

A high-severity server-side request forgery in conductor from conductor-oss. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.3%top 79.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafka_request.bootStrapServers results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks.

Affected products (as reported)

Vendor	Product	Versions
conductor-oss	conductor	3.33.0-rc10

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C

References

VDB-416947 | conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery vdb-entry, technical-description
VDB-416947 | CTI Indicators (IOB, IOC, IOA) signature, permissions-required
CVE-2026-109405 | CVE Analysis and Report third-party-advisory
Submit #979793 | Conductor OSS Conductor >= 3.16.0 (audited commit ce46eac) server-side request forgery (CWE-918) third-party-advisory