Camunda has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was October 2026 with 4. The median CVSS is 8.1 (high), with 1 rated critical.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-109432Critical· 9.8Camunda Expression Injection via orQueries RCE66CVE-2026-109431High· 8.1Camunda Missing Authorization in Task Sub-Resources57CVE-2026-77226High· 8.1Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the…57CVE-2026-109433Medium· 6.5Camunda Broken Access Control via Cockpit48
Camunda vulnerabilities
CVEs affecting Camunda, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-109431High· 8.1PoCCamunda Missing Authorization in Task Sub-Resources
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and atta…
CVE-2026-109433Medium· 6.5PoCCamunda Broken Access Control via Cockpit
Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractC…
CVE-2026-109432Critical· 9.8PoCCamunda Expression Injection via orQueries RCE
Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate() fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allo…
CVE-2026-77226High· 8.1PoCCamunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the…
Camunda 7.24.0 before 7.24.15 contains an incorrect authorization vulnerability in the Admin web application's first-run setup endpoint, where SetupResource incorrectly determines setup availability by counting only direct members of the…