CVE-2026-109432: Camunda 7 Expression Injection via orQueries Bypasses Ad-Hoc Query Restriction

Overview

A critical expression injection vulnerability has been disclosed in Camunda 7, the widely deployed open-source workflow and decision automation engine. Tracked as CVE-2026-109432 with a maximum-severity CVSS score of 9.8, the flaw lives in AdhocQueryValidator.validate(), which fails to check sub-query expression maps nested inside the orQueries field exposed by TaskQueryDto. That gap lets an authenticated user sidestep the engine's enableExpressionsInAdhocQueries restriction entirely and execute arbitrary JUEL (Java Unified Expression Language) expressions — a path that can escalate to Java reflection and full operating-system command execution.

The vulnerability was published to NVD on October 19, 2026, alongside a related, lower-severity companion disclosure, CVE-2026-109431 (a missing-authorization flaw in task sub-resources, CVSS 8.1).

Technical Details

How It Works

A restriction that only checked the top level

Camunda 7 ships an engine-wide configuration flag, enableExpressionsInAdhocQueries, that administrators can disable to prevent user-supplied task queries from evaluating expressions at all — a safeguard added specifically to stop expression-injection abuse of the ad-hoc query API. AdhocQueryValidator.validate() is the gatekeeper responsible for enforcing that flag before a query is allowed to run.

Exploiting orQueries

TaskQueryDto — the object backing Camunda's task search API — supports an orQueries field that lets a caller bundle multiple sub-query conditions together. The validator checked the outer query object for disallowed expressions but never walked into the expression maps nested inside each orQueries entry. An authenticated caller could therefore place a forbidden expression — for example, inside a field like dueAfterExpression — not in the top-level query, but in one of its orQueries sub-queries, and the validator would wave it through even with enableExpressionsInAdhocQueries set to disabled.

From JUEL to OS command execution

Once a malicious JUEL expression reaches the evaluation engine, it can be crafted to reach Java reflection APIs and ultimately invoke java.lang.Runtime.exec(), giving the attacker arbitrary command execution with the privileges of the Camunda process engine's service account. Because the entry point is the standard task query REST endpoint, no special network position or workflow deployment access is required beyond a valid, authenticated session.

Impact Assessment

Recommendations

For Camunda Administrators

• Upgrade immediately to Camunda 7.24.14 (7.24.x branch) or 7.23.17 (7.23.x branch), which close the orQueries validation gap
• Treat this as urgent even in internal-only deployments — the only prerequisite is a valid, authenticated account, which is a low bar in most organizational deployments
• After patching, audit recent task query activity for unusual orQueries payloads, unexpected dueAfterExpression values, or other expression-shaped strings in query logs

For Security Teams

• Where immediate patching is not possible, disable both enableExpressionsInAdhocQueries and enableExpressionsInStoredQueries via process engine configuration as an interim compensating control — note this is defense-in-depth, not a confirmed full mitigation for this specific bypass, so patching remains the priority
• Monitor process/engine logs for anomalous child-process spawns from the Camunda service account, which would indicate successful Runtime.exec() abuse
• Review authentication and authorization boundaries for who can reach the Task Query REST API; this vulnerability meaningfully raises the value of any account able to call it

For Developers Embedding Camunda

• Review any custom code or integrations that pass user-controlled input into TaskQuery/orQueries construction, even indirectly
• After upgrading, re-test saved filters and custom TaskQuery code that relies on expressions — Camunda's broader expression-handling hardening in this area has previously required an allow-list review of legitimate use cases
• Avoid granting task-query API access to broad or external user populations until the patched version is confirmed in production

Key Takeaways

1. CVE-2026-109432 (CVSS 9.8) lets an authenticated Camunda 7 user bypass the enableExpressionsInAdhocQueries restriction entirely by hiding a malicious expression inside a TaskQueryDto.orQueries sub-query, which AdhocQueryValidator.validate() never inspected.
2. The bypass can escalate from JUEL expression evaluation to Java reflection and Runtime.exec(), resulting in arbitrary OS command execution as the engine's service account.
3. Affected versions are Camunda 7.24.0 through 7.24.13 and 7.23.0 through 7.23.16; fixed versions are 7.24.14 and 7.23.17.
4. Exploitation requires only an authenticated session — no administrative privileges and no user interaction — making this a meaningful privilege-escalation path in any multi-user deployment.
5. Disabling both expression-related engine flags is a reasonable stopgap, but upgrading to the patched release is the only confirmed fix for this specific validation gap.
6. A related flaw, CVE-2026-109431 (CVSS 8.1, missing authorization on task attachments/comments), was disclosed alongside it — review both advisories when planning remediation.

Sources

• NVD — CVE-2026-109432
• Strix — CVE-2026-109432: Camunda 7 OS Command Injection (CVSS 9.8)
• HOL Guard — Camunda Expression Injection via orQueries RCE (CVE-2026-109432)
• Camunda — Security Notices (Camunda 7)