{"id":"CVE-2026-109432","kind":"vulnerability","aliases":["CVE-2026-109432"],"related":[],"title":"Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where…","description":"Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.","summary":"Camunda 7 (7.23.0 to 7.23.16, 7.24.0 to 7.24.13) fails to attach the ad-hoc expression validator to OR sub-queries. A crafted JUEL expression, such as dueAfterExpression inside orQueries on the task query REST endpoint, runs OS commands as the engine user. This works even though enableExpressionsInAdhocQueries is false by default. A hardened instance needs only an account with no grants. The stock run image answers unauthenticated. A curl PoC is public. No exploitation has been reported.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Camunda 7","fixed":["7.24.16","7.23.17"],"affected":">= 7.24.0, < 7.24.14; >= 7.23.0, < 7.23.17","ecosystem":"vendor"}],"ecosystems":[],"tags":["bpmn","camunda","expression-injection","java","package","rce","self-hosted"],"not_affected_if":["camunda-8","enableexpressionsinadhocqueries-disabled-or-no-authenticated-users","engine-rest-not-exposed","managed-hosting"],"how_to_check":"Check the Camunda 7 version (engine jar or Cockpit footer): affected if 7.23.0 to 7.23.16 or 7.24.0 to 7.24.13. Check whether engine-rest (POST /task, /task/count) is reachable and whether authentication is enabled. In the camunda-bpm-run image, default.yml does not set run.auth.enabled. Setting enableExpressionsInAdhocQueries=false does NOT protect. For detection, look in REST access logs for POST /task or /task/count bodies containing orQueries with *Expression keys, and for unexpected child processes of the engine JVM.","fix":"Enterprise: upgrade to 7.24.16 or later on the 7.24 line, not 7.24.14, which Camunda notices 168 and 171 list as vulnerable to other CVEs. On the 7.23 line the CVE record names 7.23.17, which no Camunda notice mentions, so confirm with Camunda support. Community Edition ended in Oct 2025 and has no release, so migrate or patch the source. The researcher suggests calling addValidator(AdhocQueryValidator.INSTANCE) in the TaskQueryImpl constructor. Until then, keep engine-rest off untrusted networks and require authentication in front of it.","status":"open","published_at":"2026-10-19T16:17:02+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","triaged_at":"2026-10-23T22:04:40+00:00","updated_at":"2026-10-23T23:25:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-23T22:04:40Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Camunda 7 to 7.24.14 or later for the 7.24 line, or 7.23.17 or later for the 7.23 line.\nunknown","reach":"network","impact":"high","summary":"Camunda 7 workflow engine versions 7.24.0 to 7.24.14 and 7.23.0 to 7.23.17 let a logged-in user bypass the expression restriction on task queries. A crafted JUEL expression in an orQueries entry runs arbitrary Java, including OS commands, as the engine service user.","category":"package","who_cares":["camunda","java","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated users run OS commands as the engine service user","analyst_note":"Confirm the exact version range and whether the enableExpressionsInAdhocQueries default is off; check the Camunda security advisory for mitigations and how to detect exploitation.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["camunda-8","enableExpressionsInAdhocQueries-disabled-or-no-authenticated-users"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000499,"input_tokens":2874,"output_tokens":424,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the exact version range and whether the enableExpressionsInAdhocQueries default is off; check the Camunda security advisory for mitigations and how to detect exploitation.","search":"'-109432':16A,19A '-2026':15A,18A '7':21A,34B '7.23.0':6A,35B,117C '7.23.16':37B '7.23.17':8A,119C '7.24.0':2A,38B,113C '7.24.13':40B '7.24.14':4A,115C 'account':92B 'achiev':165C 'ad':46B 'ad-hoc':45B 'adhocqueryvalidator.validate':126C 'allow':142C 'answer':100B 'arbitrari':166C 'attach':43B 'attack':150C 'authent':143C 'bpmn':22B 'bypass':146C 'camunda':1A,20A,23B,33B,112C 'check':129C 'command':72B,177C 'contain':9A,120C 'craft':56B 'curl':103B 'cve':14A,17A 'default':85B 'dueafterexpress':61B,159C 'enableexpressionsinadhocqueri':81B,148C 'endpoint':69B 'engin':75B,181C 'entri':163C 'even':79B 'execut':178C 'exploit':108B 'expos':139C 'express':11A,25B,48B,58B,122C,133C,156C 'expression-inject':24B 'fail':41B,127C 'fals':83B 'field':138C 'grant':95B 'harden':87B 'hoc':47B 'host':32B 'imag':99B 'inject':12A,26B,123C 'insid':62B,160C 'instanc':88B 'invok':170C 'java':27B,167C 'java.lang.runtime.exec':171C 'juel':57B,155C 'malici':154C 'map':134C 'need':89B 'oper':175C 'operating-system':174C 'orqueri':63B,137C,162C 'os':71B 'packag':28B 'poc':104B 'public':106B 'queri':54B,67B,132C 'rce':29B 'reflect':168C 'report':111B 'rest':68B 'restrict':149C 'result':172C 'run':70B,98B 'self':31B 'self-host':30B 'servic':182C 'stock':97B 'sub':53B,131C 'sub-queri':52B,130C 'suppli':152C 'system':176C 'task':66B 'taskquerydto':141C 'though':80B 'unauthent':101B 'user':76B,144C,183C 'valid':49B 'vulner':13A,124C 'within':135C 'work':78B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T16:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-109432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109432","severity":null,"published_at":"2026-10-19T16:17:02+00:00","modified_at":"2026-10-19T21:14:14+00:00","first_seen_at":"2026-10-23T21:57:18+00:00","fetched_at":"2026-10-23T22:28:57+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109432:439","url":null,"severity":null,"published_at":"2026-10-23T23:25:37+00:00","modified_at":"2026-10-23T23:25:37+00:00","first_seen_at":"2026-10-23T23:25:37+00:00","fetched_at":"2026-10-23T23:25:37+00:00","note":"Camunda has no notice for this CVE. Range and PoC come from the CNA (VulnCheck) and the CodeAnt researcher writeup. Camunda notices 168/171 call 7.24.14 and 7.24.15 vulnerable to other CVEs, so the CVE record's fix of 7.24.14 is stale. The enableExpressionsInAdhocQueries default is false, but the bug bypasses it. No exploitation reported, not in KEV. Reproduction was by the researcher only."}],"documents":[{"id":1950,"url":"https://codeant.ai/security-research/camunda-adhoc-query-expression-rce-cve-2026-109432","title":"CVE-2026-109432: The Validator That Had Nothing to Validate, a Camunda RCE (CodeAnt AI)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1951,"url":"https://docs.camunda.org/security/notices/","title":"Camunda security notices (168, 171: 7.24.14/7.24.15 superseded)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1952,"url":"https://www.vulncheck.com/advisories/camunda-expression-injection-via-orqueries-rce","title":"VulnCheck advisory (CNA): Camunda Expression Injection via orQueries RCE","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1953,"url":"https://severitydaily.com/camunda-7-cve-2026-109432-9-3-orqueries-rce-fix-version-7-24-14-superseded-notices-community-edition-eol/","title":"Severity Daily: Camunda record names 7.24.14 as fix; vendor notices call it vulnerable","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}