---
id: "CVE-2026-109432"
kind: "vulnerability"
aliases: ["CVE-2026-109432"]
title: "Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "Camunda 7", "fixed": ["7.24.16", "7.23.17"], "affected": ">= 7.24.0, < 7.24.14; >= 7.23.0, < 7.23.17", "ecosystem": "vendor"}]
ecosystems: []
tags: ["bpmn", "camunda", "expression-injection", "java", "package", "rce", "self-hosted"]
not_affected_if: ["camunda-8", "enableexpressionsinadhocqueries-disabled-or-no-authenticated-users", "engine-rest-not-exposed", "managed-hosting"]
published_at: "2026-10-19T16:17:02+00:00"
first_seen_at: "2026-10-23T21:57:18+00:00"
updated_at: "2026-10-23T23:25:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109432", "first_seen_at": "2026-10-23T21:57:18+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:25:37+00:00"}]
---

# Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where…

Camunda 7 (7.23.0 to 7.23.16, 7.24.0 to 7.24.13) fails to attach the ad-hoc expression validator to OR sub-queries. A crafted JUEL expression, such as dueAfterExpression inside orQueries on the task query REST endpoint, runs OS commands as the engine user. This works even though enableExpressionsInAdhocQueries is false by default. A hardened instance needs only an account with no grants. The stock run image answers unauthenticated. A curl PoC is public. No exploitation has been reported.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Camunda 7 affected >= 7.24.0, < 7.24.14; >= 7.23.0, < 7.23.17 fixed 7.24.16, 7.23.17

## How to check

Check the Camunda 7 version (engine jar or Cockpit footer): affected if 7.23.0 to 7.23.16 or 7.24.0 to 7.24.13. Check whether engine-rest (POST /task, /task/count) is reachable and whether authentication is enabled. In the camunda-bpm-run image, default.yml does not set run.auth.enabled. Setting enableExpressionsInAdhocQueries=false does NOT protect. For detection, look in REST access logs for POST /task or /task/count bodies containing orQueries with *Expression keys, and for unexpected child processes of the engine JVM.

## Fix

Enterprise: upgrade to 7.24.16 or later on the 7.24 line, not 7.24.14, which Camunda notices 168 and 171 list as vulnerable to other CVEs. On the 7.23 line the CVE record names 7.23.17, which no Camunda notice mentions, so confirm with Camunda support. Community Edition ended in Oct 2025 and has no release, so migrate or patch the source. The researcher suggests calling addValidator(AdhocQueryValidator.INSTANCE) in the TaskQueryImpl constructor. Until then, keep engine-rest off untrusted networks and require authentication in front of it.

## Timeline

- 2026-10-23T21:57:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109432
- 2026-10-23T23:25:37+00:00 analyst — Camunda has no notice for this CVE. Range and PoC come from the CNA (VulnCheck) and the CodeAnt researcher writeup. Camunda notices 168/171 call 7.24.14 and 7.24.15 vulnerable to other CVEs, so the CVE record's fix of 7.24.14 is stale. The enableExpressionsInAdhocQueries default is false, but the bug bypasses it. No exploitation reported, not in KEV. Reproduction was by the researcher only.

## Documents

- [advisory] VulnCheck advisory (CNA): Camunda Expression Injection via orQueries RCE https://www.vulncheck.com/advisories/camunda-expression-injection-via-orqueries-rce
- [discussion] Severity Daily: Camunda record names 7.24.14 as fix; vendor notices call it vulnerable https://severitydaily.com/camunda-7-cve-2026-109432-9-3-orqueries-rce-fix-version-7-24-14-superseded-notices-community-edition-eol/
- [fix] Camunda security notices (168, 171: 7.24.14/7.24.15 superseded) https://docs.camunda.org/security/notices/
- [poc] CVE-2026-109432: The Validator That Had Nothing to Validate, a Camunda RCE (CodeAnt AI) https://codeant.ai/security-research/camunda-adhoc-query-expression-rce-cve-2026-109432

## From the sources

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_