CVE-2026-109432
Description
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.
How to fix
- Camunda Camunda 77.24.14, 7.23.17 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Camunda Camunda 7 | 7.24.0 ≤ v < 7.24.14, 7.23.0 ≤ v < 7.23.17 | 7.24.14, 7.23.17 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.