CVE-2026-109432
Received Received - Intake

Command Injection in Camunda Workflow Engine

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulnCheck

Description
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-109432
EUVD
EUVD-2026-104392

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Camunda Camunda 7 7.24.0
Camunda Camunda 7 7.23.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-917 The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
CWE-78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a critical expression injection vulnerability in Camunda 7 versions 7.24.0 to 7.23.17. The flaw exists in the AdhocQueryValidator.validate() function, which fails to properly validate sub-query expressions within the orQueries field of TaskQueryDto. Attackers can inject malicious JUEL expressions to bypass security restrictions and execute arbitrary Java reflection, leading to operating-system command execution with Camunda engine service user privileges.

Detection Guidance

Check Camunda server logs for suspicious TaskQueryDto requests containing orQueries fields with expressions like dueAfterExpression. Inspect network traffic for unauthorized command execution attempts from the Camunda service account. Review system logs for unexpected processes spawned by the camunda user.

Impact Analysis

An attacker with authenticated access can exploit this to execute arbitrary operating-system commands as the Camunda service user. This could lead to full system compromise, data theft, or disruption of Camunda services. The vulnerability allows bypassing intended security controls even in hardened instances with authentication and authorization enabled.

Compliance Impact

This vulnerability could lead to unauthorized access, data exfiltration, or system manipulation, which would violate compliance requirements for GDPR (data protection), HIPAA (health information security), and other regulations mandating strict access controls and auditability.

Mitigation Strategies

Upgrade Camunda to versions 7.24.14 or later or 7.23.17 or later. If upgrading is not possible, disable ad-hoc queries entirely by setting enableExpressionsInAdhocQueries to false and restrict access to TaskQueryDto endpoints. Apply network-level restrictions to prevent unauthorized command execution from the Camunda service account.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109432. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart