Read the docs
TI-2026-76421 Aliases CVE-2026-109432GHSA-mqfw-m4cx-w4jp

Expression injection in Camunda 7 orQueries enables command execution

Priority HIGH 81CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

Camunda 7 from 7.24.0 before 7.24.14 and from 7.23.0 before 7.23.17 contains an expression injection flaw in AdhocQueryValidator.validate(), which fails to check sub-query expression maps in the orQueries field. An authenticated user can supply a malicious JUEL expression in an orQueries entry to bypass the enableExpressionsInAdhocQueries restriction. The expression reaches java.lang.Runtime.exec, allowing operating-system command execution as the engine service user. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00558 46th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed Camunda 7 (Camunda): 7.24.14, 7.23.17

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
CamundaCamunda 77.24.0 to before 7.24.14; 7.23.0 to before 7.23.177.24.14, 7.23.17Patch availableCNA
  • Camunda 7 VendorCamunda Affected 7.24.0 to before 7.24.14; 7.23.0 to before 7.23.17 Fixed in 7.24.14, 7.23.17 Patch available CNA

Remediation

Upgrade Camunda 7 to version 7.24.14 or 7.23.17.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA Camunda 7 (Camunda) Fixed in 7.24.14, 7.23.17

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Camunda 7 7.23.17, 7.24.14

    2 records Highest priority Priority HIGH 2 HIGH

    Other records, highest priority first

    • TI-2026-76420 Missing authorization in Camunda task comments and attachmentsPriority HIGH 72
    Show all 2 records →

Timeline

  1. 2026-10-19 Threatist record created from CVE-2026-109432
  2. 2026-10-20 Alias added: GHSA-mqfw-m4cx-w4jp

References

Exploit 1

Patch 1

  • TI-2026-68026 Incorrect authorization in Camunda 7 setup lets attackers add admins CVSS 4.0CRITICAL 9.2
  • TI-2026-76420 Missing authorization in Camunda task comments and attachments CVSS 4.0HIGH 8.6
  • TI-2026-76422 Broken access control in Camunda Cockpit exposes process data CVSS 4.0MEDIUM 6.0
  • TI-2021-09385 Camunda Modeler (aka camunda-modeler) through 4.6.0 allows arbitrary file access. CVSS 3.1CRITICAL 9.1
  • TI-2021-06144 Prototype pollution in min-dash CVSS 3.1HIGH 7.5
  • TI-2024-34492 WordPress bpmn.io plugin <= 1.0 - Stored Cross Site Scripting (XSS) vulnerability CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences