CVE-2026-109432: Camunda Expression Injection via orQueries RCE
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Camundato a version that resolves this vulnerability.Fixed in 7.24.14 - Upgrade
Upgrade
Camundato a version that resolves this vulnerability.Fixed in 7.23.17
Event History
Frequently Asked Questions
Which deployments are exposed?
Camunda 7.24.0 through before 7.24.14 and Camunda 7.23.0 through before 7.23.17 are affected. The vulnerable path is exposed through TaskQueryDto and its orQueries field.
What access does an attacker need?
An attacker needs authentication, but no additional privileges or user interaction. They can submit a malicious JUEL expression in an orQueries sub-query, such as dueAfterExpression.
Does disabling expressions in ad hoc queries prevent exploitation?
No. The flaw bypasses the enableExpressionsInAdhocQueries restriction because AdhocQueryValidator.validate() does not validate sub-query expression maps in orQueries.
What is the impact of successful exploitation?
An attacker can use Java reflection to invoke java.lang.Runtime.exec and execute operating-system commands as the engine service user. This can compromise confidentiality, integrity, and availability at the privileges of that service account.