External risk intelligence

Camunda Expression Injection Allows OS Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-109432

Camunda is a workflow and process automation platform typically deployed as a web application or API service to handle business processes. While it often operates within internal enterprise environments, these platforms are commonly configured as web-accessible services for integration with other enterprise systems, APIs, and administrative interfaces, making them reachable via the network in many common deployment patterns.

OS Command Injection

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in Camunda's workflow and process automation software. The issue allows authenticated users to execute arbitrary operating system commands by exploiting an expression injection flaw within its querying functionality. This could potentially lead to unauthorized access and control over the engine's environment.

Flaw allows command execution through data input.
Business processes could be compromised.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending a specially crafted query to an exposed TaskQueryDto endpoint. This bypasses existing restrictions, allowing the injection of malicious expressions. If successful, this could lead to the execution of arbitrary operating-system commands.

Network access to vulnerable endpoint required.
Injects malicious JUEL into orQueries field.
Leads to operating-system command execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an authenticated user to execute arbitrary operating system commands by injecting malicious expressions into a query. This could impact the availability or integrity of the Camunda engine service and the underlying operating system.

Engine service user operating system commands.
Malicious expressions in query fields.
Compromise of service availability or integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Camunda platform is likely managed by application owners or platform teams, with security and network teams responsible for its exposure. The first action is to identify all Camunda instances, assess their reachability and business criticality, and then confirm the accountable owner for remediation planning.

Ownership: Application or Platform Teams.
Verify first: Instance reachability and criticality.
Action: Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Camunda?

Camunda is an open-source workflow and process automation platform. Organizations use it to orchestrate business processes, manage complex workflows, and automate tasks through its engine. It serves as a central hub for executing process models, often interacting with other enterprise systems via APIs and web-based administrative interfaces.

What is the vulnerability in CVE-2026-109432?

This is an expression injection flaw, classified as CWE-917 and CWE-78. The software fails to properly sanitize certain query inputs, allowing users to inject malicious code. Specifically, the system executes these injected expressions as operating system commands, potentially giving an attacker the same level of control as the Camunda engine service user.

How can an attacker trigger this issue?

An attacker triggers this by sending a crafted request to the TaskQueryDto endpoint containing a malicious JUEL expression within the 'orQueries' field. It is important to note that sending standard, non-malicious queries or interacting with unrelated platform components does not trigger this vulnerability; the malicious payload must specifically target the sub-query expression maps that the validator fails to check.

Is my Camunda instance at risk?

According to Halo Surface Signal, risk depends heavily on how your instance is deployed. Because Camunda acts as a web-accessible service for integration, many instances are reachable over a network. If your Camunda API or administrative interface is accessible from a wider network rather than being restricted to a strictly private, isolated environment, it is more likely to be exposed to this type of remote interaction.

What steps should I take if I use Camunda?

Start by identifying all instances of Camunda across your environment to understand your footprint. Coordinate with the platform or application teams responsible for these services to confirm their current version. Assess whether the instance is reachable over the network, then prioritize the application of official vendor patches to remediate the vulnerability in your affected environments.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.