Block Command Execution in Camunda 7 by Restricting Query Access
Authenticated users can execute OS commands in vulnerable Camunda 7 versions by injecting expressions into query fields, bypassing safety controls.
Key points
- CVE-2026-109432 allows remote OS command execution via expression injection.
- The flaw affects Camunda 7.23 and 7.24 series before specific patch versions.
- Attackers bypass the enableExpressionsInAdhocQueries security restriction.
Camunda 7 workflow engine instances are exposed to remote operating-system command execution due to a critical expression injection vulnerability. The flaw allows any authenticated user to bypass configured safety restrictions and run arbitrary system commands. This exposure affects environments running specific versions of the Camunda 7 platform that have not yet applied the vendor's corrective updates. Security teams must verify their deployment versions immediately to determine if their infrastructure falls within the affected range.
The risk
The vulnerability, identified as CVE-2026-109432, carries a CVSS score of 9.3, rated as critical. According to the National Vulnerability Database, the issue stems from the AdhocQueryValidator.validate() function failing to inspect sub-query expression maps. This oversight occurs within the orQueries field exposed by the TaskQueryDto component. An attacker can supply a malicious JUEL expression, such as dueAfterExpression, inside an orQueries entry. This action enables arbitrary Java reflection, allowing the invocation of java.lang.Runtime.exec. The resulting command execution runs with the privileges of the engine service user.
Who is exposed
Organizations using Camunda 7 versions 7.23.0 through 7.23.16 are vulnerable to this attack. Similarly, deployments running Camunda 7.24.0 through 7.24.13 are exposed. Any authenticated user who can interact with the task query interface can exploit this weakness. The flaw allows attackers to bypass the enableExpressionsInAdhocQueries restriction, which is typically intended to limit expression execution. This means that even if administrators have disabled ad-hoc query expressions, the specific sub-query validation failure still permits the injection payload to execute successfully.
Cost and compliance
The source material does not provide details regarding financial costs, regulatory fines, or specific compliance framework impacts associated with this vulnerability. No information is available about data breach notifications or legal liabilities stemming from this specific flaw. Security teams must evaluate the impact based on their own internal risk assessments and the sensitivity of the data processed by their Camunda instances.
Our take on the response
This vulnerability highlights the complexity of validating nested data structures in query interfaces. Defenders should prioritize version remediation for affected Camunda 7 deployments. Until patches are applied, restricting network access to the Camunda API endpoints can reduce the attack surface. Monitoring for unusual Java reflection calls or process executions from the engine service account is essential for early detection of exploitation attempts.
What defenders should look for
Teams usually detect this activity by monitoring for unexpected process executions originating from the application service account. Check application logs for JUEL expression parsing errors or unusual query parameters containing reflection methods. Look for outbound network connections from the workflow engine that do not match normal operational patterns. Verify that the enableExpressionsInAdhocQueries setting is enforced, although this specific flaw bypasses it. Investigate any sudden spikes in CPU usage or resource consumption on the host server, which may indicate command execution.
What to do and how to stay safe: Camunda
- Inventory all Camunda 7 installations and compare version numbers against the affected ranges listed in the advisory.
- Restrict network access to the Camunda API to trusted internal networks only, reducing the pool of potential attackers.
- Monitor system logs for unexpected command executions or new processes spawned by the Camunda service user.
- Review authentication logs for any unusual query patterns or high-frequency access attempts from single accounts.
Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps
General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Camunda 7 versions are affected by CVE-2026-109432?
Versions 7.23.0 before 7.23.17 and 7.24.0 before 7.24.14 are vulnerable to this expression injection flaw.
What is the CVSS score for this vulnerability?
The National Vulnerability Database rates CVE-2026-109432 with a CVSS score of 9.3, which is critical.
Can unauthenticated users exploit this vulnerability?
No, the source material states that the vulnerability allows authenticated users to bypass restrictions and execute commands.
