Conductor OSS EUVD-2026-98544

Requires that the Kafka contrib module is deployed and a KafkaPublishTask is usable, and that the attacker can create or execute a workflow/task in which they control the kafka_request.bootStrapServers argument (affected versions through conductor-oss Conductor 3.33.0-rc10). Exploitation is limited to connections the Kafka client can make (not arbitrary HTTP/protocol SSRF), and impact is low per CVSS (VC/VI/VA:L, no subsequent-system impact). The primary limiting factor is access to the Conductor API: although rated PR:N, in practice the attacker must be able to submit tasks, so a Conductor deployment that is not internet-exposed or that enforces authentication/authorization on workflow submission substantially reduces real-world exploitability.

This is a medium-severity SSRF (CWE-918) rated CVSS 4.0 5.5 by VulDB, and the signals are internally consistent rather than conflicting. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remotely reachable, low-complexity, no-interaction flaw, and the E:P (Proof-of-Concept) exploit-maturity value aligns with the description's statement that exploit code has been released publicly - so this is 'publicly available exploit code exists', NOT confirmed active exploitation. It is NOT in CISA KEV and no EPSS score was provided in the input, so widespread opportunistic exploitation cannot be asserted from the data. The impact metrics are the key tempering factor: VC:L/VI:L/VA:L with no subsequent-system impact (SC/SI/SA:N) means limited confidentiality/integrity/availability effect confined to the vulnerable host - typical of an SSRF that pivots via the Kafka client rather than a full RCE. The most important caveat is the PR:N claim: VulDB rates this unauthenticated, but exploitation realistically requires the ability to submit or execute a workflow containing a KafkaPublishTask with attacker-controlled bootStrapServers - whether that is truly unauthenticated depends entirely on whether the Conductor API is exposed and whether authentication is configured. Verify the deployment's exposure and auth posture before treating PR:N as confirmed. Overall: a real, publicly-exploitable issue worth patching, but a moderate priority rather than an emergency given limited impact, niche product footprint, and no KEV/active-exploitation evidence.

An attacker able to reach the Conductor workflow API submits or triggers a workflow using a KafkaPublishTask and sets the kafka_request.bootStrapServers parameter to an internal or attacker-chosen host:port. The Conductor server then initiates a Kafka client connection to that address on the attacker's behalf, enabling probing of internal network services otherwise unreachable from outside. Public exploit code for this flaw has been released, lowering the effort required to reproduce it.