CVE-2026-109405 conductor-oss conductor KafkaPublishTask.java KafkaPublishTask.start server-side request forgery

A security flaw has been discovered in conductor-oss conductor up to 3.33.0-rc10. This affects the function KafkaPublishTask.start of the file kafka/src/main/java/com/netflix/conductor/contribs/tasks/kafka/KafkaPublishTask.java. The manipulation of the argument kafkarequest.bootStrapServers resul...