CVE-2026-109432 Details
Description
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.
A critical expression injection vulnerability has been identified in Camunda versions 7.24.0 prior to 7.24.14 and 7.23.0 prior to 7.23.17. The vulnerability arises because the AdhocQueryValidator.validate() method does not properly validate sub-query expression maps within the orQueries field of TaskQueryDto. This oversight allows authenticated users to bypass the default restriction that disables expressions in ad-hoc queries. Attackers can exploit this by injecting a malicious JUEL expression, such as dueAfterExpression, into an orQueries entry. This exploitation enables arbitrary Java reflection, allowing the invocation of java.lang.Runtime.exec to execute operating system commands as the engine service user.
Camunda 7 Community Edition has reached its End of Life, so a local patch is the only realistic remedy.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://codeant.ai/security-research/camunda-adhoc-query-expression-rce-cve-2026-109432 | [email protected] | ExploitRemedyTechnical Analysis |
| https://docs.camunda.org/enterprise/download/ | [email protected] | Vendor |
| https://www.vulncheck.com/advisories/camunda-expression-injection-via-orqueries-rce | [email protected] | AdvisoryBundle |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | [email protected] |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Camunda | >= 7.24.0, < 7.24.14 (semver) >= 7.23.0, < 7.23.17 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |