CVE-2026-109432
Camunda Expression Injection via orQueries RCE
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Fix
- Fixed in 7.24.14, 7.23.17
- Public exploit
- None on Exploit-DB
CISA SSVC
- Exploitation: poc
- Automatable: yes
- Technical impact: total
?
Decision points from CISA's Vulnrichment, assessed (SSVC 2.0.3).
SSVC documentationSummary
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.
Affected versions
- Camunda Camunda 7
From 7.24.0 · fixed in 7.24.14; From 7.23.0 · fixed in 7.23.17