Camunda vulnerabilities
We track 3 vulnerabilities in Camunda products. 3 are rated high or critical, and none are known to be exploited. The most recent was published on October 19, 2026.
Latest Camunda vulnerabilities
- 9.8 Critical severity
Camunda 7: Improper Neutralization of Special Elements used in an OS Command
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated user
- 8.1 High severity
Camunda 7: Authorization Bypass Through User-Controlled Key
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling sing
- 8.1 High severity
Camunda 7: Incorrect Authorization
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the camunda-admin group ra