CVE-2026-109432
9.8CriticalPublished 19 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-78, CWE-917
Impact
Authenticated users can execute arbitrary operating-system commands as the engine service user via Java reflection. Attackers only need network access and valid credentials to send a malicious TaskQueryDto request.
Root cause
AdhocQueryValidator.validate() fails to validate sub-query expression maps inside the orQueries field, bypassing the enableExpressionsInAdhocQueries check and evaluating untrusted JUEL expressions.
Affected systems
Camunda 7.23.0 before 7.23.17 and 7.24.0 before 7.24.14
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade to Camunda 7.23.17, 7.24.14, or later. If patching immediately is not possible, restrict access to task query endpoints or block requests containing orQueries payloads with JUEL expressions at your reverse proxy or WAF.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.