Live › vulnerability › CVE-2026-109432
Go to dashboardCamunda 7 (7.23.0 to 7.23.16, 7.24.0 to 7.24.13) fails to attach the ad-hoc expression validator to OR sub-queries. A crafted JUEL expression, such as dueAfterExpression inside orQueries on the task query REST endpoint, runs OS commands as the engine user. This works even though enableExpressionsInAdhocQueries is false by default. A hardened instance needs only an account with no grants. The stock run image answers unauthenticated. A curl PoC is public. No exploitation has been reported.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| Camunda 7 | vendor | >= 7.24.0, < 7.24.14; >= 7.23.0, < 7.23.17 | 7.24.16, 7.23.17 |
7.23.0 to 7.23.16 or 7.24.0 to 7.24.137.24.16 or later on the 7.24 line, not 7.24.14, which Camunda notices 168 and 171 list as vulnerable to other CVEs7.23.17, which no Camunda notice mentions, so confirm with Camunda supportEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.
This page as .md · .json · in your agent: get_signal("CVE-2026-109432")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.