Camunda 7: Expression injection in orQueries leads to remote code execution
Summary
Camunda 7 versions 7.24.0 to before 7.24.14 and 7.23.0 to before 7.23.17 do not validate expressions in OR sub-queries of the task query API. An authenticated user can inject a JUEL expression into an orQueries entry and run operating-system commands as the engine service user. The vendor's default setting that forbids expressions in ad-hoc queries does not prevent this, so no configuration change is known to block it. Public proof-of-concept code is claimed by third parties but has not been verified.
Affected
- Camunda 7 7.24.0 to before 7.24.14
- Camunda 7 7.23.0 to before 7.23.17
- Versions 7.22.x and older: Unknown.
Fixed in
- Upgrade to Camunda 7.24.14 or later, or 7.23.17 or later.
- Note: a Camunda security notice lists 7.24.15 as a fix; confirm the correct version with Camunda.
- Camunda 7 Community Edition is End of Life and receives no further security patches; a local patch or migration is the realistic remedy.
Workaround
- No verified workaround. The bypassed setting enableExpressionsInAdhocQueries is already false by default, so disabling it does not stop this issue.
- A Camunda notice recommends disabling enableExpressionsInAdhocQueries and enableExpressionsInStoredQueries, but it could not be confirmed to cover this CVE.
- Restrict network access to the Camunda REST API and Tasklist.
Exploitation
- CISA SSVC: exploitation 'poc', automatable yes, technical impact total.
- Not known to be exploited in the wild.
- A third-party page claims proof-of-concept code; not verified.
Our recommendation
- Identify all Camunda 7 instances and their exact versions, including Maven dependencies and Docker images.
- Upgrade to a fixed version as soon as possible, after confirming the version with Camunda.
- If upgrading is not immediately possible, restrict access to the task REST API and Tasklist to trusted networks and review service-account privileges.
- For Community Edition users, plan a migration because no security patches will be released.
- Monitor the Camunda advisories and CISA KEV for changes in exploitation status.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CodeAnt AI security research write-up codeant.ai
- VulnCheck advisory www.vulncheck.com
- Camunda Enterprise Download docs.camunda.org
- Camunda Security Notices docs.camunda.org
- Camunda 7 end-of-life announcement camunda.com
- VulDB entry vuldb.com
- OpenCVE CVE record app.opencve.io
- HOL Guard CVE entry hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:15.
Original description (NVD)
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the enableExpressionsInAdhocQueries restriction. Attackers can supply a malicious JUEL expression such as dueAfterExpression inside an orQueries entry to achieve arbitrary Java reflection and invoke java.lang.Runtime.exec, resulting in operating-system command execution as the engine service user.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.