The vulnerability resides in the Conductor open‑source workflow orchestrator, specifically in the KafkaPublishTask.start method. A crafted value for the kafka_request.bootStrapServers parameter allows the Conductor service to initiate an outbound HTTP request to an arbitrary URL supplied by an attacker. The exploit is a classic Server‑Side Request Forgery that can be triggered from a remote client. Successful exploitation could lead to the retrieval of internal network resources, potential token leakage, or subsequent pivot attacks against the infrastructure.

Versions of Conductor up to 3.33.0‑rc10 are affected. The issue applies to the conductor‑oss:conductor product and is manifested when the KafkaPublishTask.start method processes the bootStrapServers argument within the kafka package. No affected versions beyond 3.33.0‑rc10 are listed in the CVE data.

The CVSS base score is 6.9, indicating moderate severity. EPSS information is not available, and the vulnerability is not present in the CISA KEV catalog, but the publicly released exploit demonstrates that remote attackers can potentially abuse the flaw. The attack vector requires the ability to invoke the Conductor API that triggers the KafkaPublishTask, which is commonly exposed in production environments.