CVE-2026-109432
CVE-2026-109432 · Camunda Expression Injection via orQueries RCE
This page contains facts from public vulnerability sources. Check the original advisory before updating.
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.
CVSS 9.3 · Critical · EPSS 0.6% · Fix available
- Published
- Updated
Affected products and versions
camunda 7
- Versions
- ≥ 7.24.0, < 7.24.14: Affected (semver)
- ≥ 7.23.0, < 7.23.17: Affected (semver)
Update to 7.23.17; Update to 7.24.14