Camunda — Security Notices https://unsupported.docs.camunda.io/8.7/docs/reference/notices/ Security notices for Camunda 8 en Tue, 06 Oct 2026 07:28:50 GMT 60 http://www.rssboard.org/rss-specification https://unsupported.docs.camunda.io/8.7/img/black-C.png Camunda — Security Notices https://unsupported.docs.camunda.io/8.7/docs/reference/notices/ Notice 64 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-64 camunda-security-notice-64 Mon, 21 Sep 2026 00:00:00 GMT A remote code execution vulnerability was identified in Camunda's FEEL expression engine allowing execution of arbitrary code within the scope of a Camunda 8 server operating system process. Camunda Orchestration Cluster (Zeebe, Operate, Tasklist) Camunda Connectors Camunda Web Modeler A remote code execution vulnerability was identified in Camunda's FEEL expression engine allowing execution of arbitrary code within the scope of a Camunda 8 server operating system process.

Severity: Critical 9.9 (CVSS v3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

This vulnerability was identified by Camunda's Security Team, with no known report or exploit beyond our own security investigation. A CVE identifier has been requested and this notice will be updated once it is assigned. For further details, see GHSA-vx3p-v6cf-vfjw.

How to determine if the installation is affected

You are using:

  • Camunda Orchestration Cluster ≤ 8.9.19 or ≤ 8.8.37
  • Camunda Zeebe, Operate, or Tasklist ≤ 8.7.39
  • Camunda Connectors ≤ 8.9.10, ≤ 8.8.19, or ≤ 8.7.25
  • Web Modeler ≤ 8.9.8, or ≤ 8.8.19

Any component that bundles org.camunda.feel:feel-engine up to and including 1.22.0 is affected. Versions older than the ones listed above, including versions that have reached end of maintenance, are also affected, with the exception of Web Modeler, where versions below 8.8.0 are not affected.

Exploitation requires one of the following:

  • The attacker is an authenticated and authorized user of the Camunda Orchestration Cluster REST API 8.9+ who has the privilege to invoke the Evaluate Expression API. The authorization requires:
    • Permission granted to user or client (directly or via role)
    • Resource type: EXPRESSION
    • Permission: EVALUATE
    • By default, this permission is granted as part of the admin role
  • The attacker is an authenticated and authorized user who has the privilege to deploy BPMN or DMN to the Camunda Orchestration Cluster:
    • Prior to 8.8: API access (gRPC or REST)
    • Starting 8.8: via gRPC or REST
    • The authorization requires:
      • Permission granted to user or client (directly or via role)
      • Resource type: Resource
      • Permission: CREATE
      • By default, this permission is granted as part of the admin role
  • The attacker is an authenticated and authorized user of Camunda Web Modeler ≤ 8.9.8 or ≤ 8.8.19

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Orchestration Cluster 8.9.21, 8.8.39
  • Camunda Zeebe, Operate, Tasklist 8.7.41
  • Camunda Connectors 8.9.12, 8.8.21, 8.7.27
  • Web Modeler Self-Managed 8.9.9, 8.8.20

These releases bundle a patched FEEL engine (1.22.1, 1.21.1, 1.20.3, 1.19.6, 1.18.6, 1.17.13, 1.16.6, or 1.15.5, depending on the component). If you embed the FEEL engine directly, upgrade org.camunda.feel:feel-engine to the patched version of your 1.x line.

Camunda 8 SaaS was fully remediated on September 12 and 13, 2026, ahead of this notice. All clusters across all supported versions, and Web Modeler SaaS, were updated to patched builds; no action is required on your part. Clusters that were suspended at that time receive the patched version when they resume.

]]> Notice 63 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-63 camunda-security-notice-63 Mon, 21 Sep 2026 00:00:00 GMT The application was vulnerable to the following vulnerabilities in the embedded Eclipse Jetty web server: Camunda Optimize The application was vulnerable to the following vulnerabilities in the embedded Eclipse Jetty web server:

  • CVE-2026-19203, where a flaw in HTTP/1.1 chunked request parsing accepts a lone line feed (LF) character as a terminator in parts of chunked requests. When deployed behind an intermediary reverse proxy that requires strict CRLF delimiters, this discrepancy in request boundary interpretation can lead to HTTP request smuggling.
  • CVE-2026-12611, where a race condition in the HTTP/2 server implementation when handling concurrent RST_STREAM and GOAWAY frames from a client can cause write-blocked threads to never be unblocked, potentially leading to thread exhaustion and a Denial of Service. The default Camunda Optimize configuration is not exploitable; this vulnerability only applies when HTTP/2 support is explicitly enabled (container.http2Enabled: true).

How to determine if the installation is affected

You are using:

  • Camunda Optimize ≤ 8.7.27

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Optimize 8.7.28
]]> Notice 62 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-62 camunda-security-notice-62 Tue, 08 Sep 2026 00:00:00 GMT The application was vulnerable to CVE-2026-75140 in jsoup's XmlTreeBuilder which could allow an attacker to exhaust JVM heap memory by supplying a deeply nested XML document (in this case a BPMN or DM... Camunda Web Modeler The application was vulnerable to CVE-2026-75140 in jsoup's XmlTreeBuilder which could allow an attacker to exhaust JVM heap memory by supplying a deeply nested XML document (in this case a BPMN or DMN diagram) with uniquely-namespaced elements.

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.9.7, ≤ 8.8.18, or ≤ 8.7.25

Solution

Camunda has provided the following releases that contain the fix:

  • Web Modeler Self-Managed 8.9.8, 8.8.19, 8.7.26

The fix was deployed to Web Modeler SaaS on August 29, 2026, 10:35 CET.

]]> Notice 61 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-61 camunda-security-notice-61 Tue, 08 Sep 2026 00:00:00 GMT The connector runtime resolves a secret reference (for example, {{secrets.MY_API_KEY}}) wherever that literal text appears in a connector's input, without restricting resolution to the field where the... Camunda Connectors The connector runtime resolves a secret reference (for example, {{secrets.MY_API_KEY}}) wherever that literal text appears in a connector's input, without restricting resolution to the field where the reference was declared. Under the following conditions, an attacker may be able to cause a connector to resolve and disclose a secret outside its intended scope:

  • The process uses connectors and secrets.
  • Untrusted input reaches a process variable — for example, through a user task, an inbound connector such as a webhook or email, or an API call.
  • That process variable is passed, unsanitized, into a connector field (for example, an email body or an HTTP request field).
  • The attacker can guess or know the name of a secret that exists in that context. This does not require knowing the secret's value, only its name.
  • The connector's destination is one the attacker controls or can observe, or the attacker can also influence the destination itself (for example, a recipient address or URL supplied through another process variable).

Severity: High (CVSS 7.5).

How to determine if the installation is affected

You are using:

  • Camunda Connectors 8.1.x through 8.9.x, on Self-Managed or SaaS, with connectors and secrets configured as described above.

Solution

Camunda has released a secret filter for the connector runtime, defaulting to STRICT mode. In STRICT mode, a connector only resolves a secret that's present for that specific field in the deployed BPMN XML, which structurally closes this vulnerability for both outbound and inbound connectors. This is a breaking change: after upgrading, a connector field that relied on resolving an undeclared secret stops resolving it. See secret filter for configuration details, including how to change the mode.

Camunda has provided the following releases which contain the fix:

  • Camunda Connectors 8.9.10, 8.8.19, 8.7.25, 8.6.28

On Camunda 8 SaaS, this fix is included automatically unless you've opted out of auto-updates, in which case you'll need to update your cluster manually. You can also change the mode per cluster in cluster settings.

Interim mitigation:

  • Review your process deployments against the preconditions above.
  • If a process may be affected, search its process instance variables for a secret-reference literal. An API-supported query for this (a $like filter on the process instance search API) is available starting with 8.8; it isn't available on 8.7.
  • Adjust the affected process so the preconditions above no longer hold, or sanitize the process variable to remove secret-reference syntax before it reaches a connector field.
    • Sanitize the respective process variable for example by replacing secrets keyword: = replace(emailBody, "secrets?\.", "secretx_", "i")
  • Rotate any secret that may have been exposed, following your organization's secret-management procedures.
]]> Notice 60 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-60 camunda-security-notice-60 Wed, 02 Sep 2026 00:00:00 GMT The application was vulnerable to CVE-2026-71290, where the embedded httpclient5 library's asynchronous transport, used to connect to the Elasticsearch/OpenSearch secondary storage, skipped hostname v... Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize The application was vulnerable to CVE-2026-71290, where the embedded httpclient5 library's asynchronous transport, used to connect to the Elasticsearch/OpenSearch secondary storage, skipped hostname verification during the TLS handshake. An attacker positioned to intercept network traffic between the affected component and its Elasticsearch/OpenSearch backend (for example, via DNS spoofing, BGP hijacking, or a compromised host on a shared network segment) could impersonate the backend, intercept the Basic authentication credentials sent to it, read or tamper with process data (including variables and process instance data) in transit, and inject forged responses back to the application. Exploitation requires this man-in-the-middle network position; it does not require bypassing authentication on the application's own API. Camunda is not aware of any known exploitation of this vulnerability.

How to determine if the installation is affected

You are using:

  • Camunda Zeebe ≤ 8.7.37
  • Camunda Tasklist ≤ 8.7.37
  • Camunda Operate ≤ 8.7.37
  • Camunda Optimize ≤ 8.7.26

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Zeebe 8.7.38
  • Camunda Tasklist 8.7.38
  • Camunda Operate 8.7.38
  • Camunda Optimize 8.7.27
]]> Notice 59 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-59 camunda-security-notice-59 Wed, 29 Jul 2026 00:00:00 GMT The version of undertow-core used by Camunda Web Modeler was affected by the following vulnerabilities which could potentially allow an attacker to perform request smuggling by exploiting flaws in the... Camunda Web Modeler The version of undertow-core used by Camunda Web Modeler was affected by the following vulnerabilities which could potentially allow an attacker to perform request smuggling by exploiting flaws in the HTTP request header parsing:

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.8.14, or ≤ 8.7.21

Solution

Camunda has provided the following releases that contain the fix:

  • Web Modeler Self-Managed 8.8.15, 8.7.22
]]> Notice 58 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-58 camunda-security-notice-58 Tue, 14 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-54399, where a flaw in the HTTP/1.1 message parser in Apache HttpComponents Core allows a remote attacker to cause a denial of service through memory exhaust... Camunda Web Modeler The application was vulnerable to CVE-2026-54399, where a flaw in the HTTP/1.1 message parser in Apache HttpComponents Core allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with an excessive number of headers or excessively long headers.

The vulnerable library is only used in outgoing HTTP requests from Web Modeler to the Camunda 8 Orchestration Cluster API. To exploit the vulnerability, an attacker would need to be able to control or intercept the API responses through a prior attack. Web Modeler's inbound HTTP requests are handled by a different library, so the vulnerable code path is not reachable from external, untrusted client traffic.

How to determine if the installation is affected

  • You are using Web Modeler Self-Managed ≤ 8.9.5, ≤ 8.8.16, or ≤ 8.7.23.

Solution

Camunda has provided the following releases which contain the fix:

  • Web Modeler Self-Managed 8.9.6, 8.8.17, 8.7.24

The fix was deployed to Web Modeler SaaS on July 8, 2026, 08:12 CET.

]]> Notice 57 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-57 camunda-security-notice-57 Tue, 14 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-54291, where database connections configured with channelBinding=require can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCR... Camunda Web Modeler The application was vulnerable to CVE-2026-54291, where database connections configured with channelBinding=require can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee.

How to determine if the installation is affected

  • You are using Web Modeler Self-Managed ≤ 8.9.5, ≤ 8.8.16, or ≤ 8.7.23.
  • And: You are using PostgreSQL with SCRAM authentication over SSL/TLS and channelBinding=require.

Solution

Camunda has provided the following releases which contain the fix:

  • Web Modeler Self-Managed 8.9.6, 8.8.17, 8.7.24

The fix was deployed to Web Modeler SaaS on July 8, 2026, 08:12 CET.

]]> Notice 56 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-56 camunda-security-notice-56 Tue, 14 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-13006, an arbitrary code execution vulnerability in the logback-core library used by Camunda Optimize. An attacker who already has write access to the Logbac... Camunda Optimize The application was vulnerable to CVE-2026-13006, an arbitrary code execution vulnerability in the logback-core library used by Camunda Optimize. An attacker who already has write access to the Logback configuration file, or the ability to inject an environment variable evaluated at startup, could execute arbitrary code in the Optimize process. Exploitation also requires the Janino library on the classpath and a Logback configuration that uses conditional (<if>) processing, both of which are present in Camunda Optimize. This vulnerability is not remotely exploitable; it requires an attacker to already hold privileged local access to the deployment.

How to determine if the installation is affected

You are using:

  • Camunda Optimize ≤ 8.7.24

Solution

Camunda has provided the following release which contains the fix:

  • Camunda Optimize 8.7.25
]]> Notice 55 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-55 camunda-security-notice-55 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-40983, where an unauthenticated attacker can send a specially crafted gRPC request to trigger uncontrolled resource consumption inside Micrometer's gRPC inst... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize The application was vulnerable to CVE-2026-40983, where an unauthenticated attacker can send a specially crafted gRPC request to trigger uncontrolled resource consumption inside Micrometer's gRPC instrumentation layer, rendering the affected component unresponsive until restarted.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.5, 8.8.14, 8.7.21
  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Camunda Optimize 8.9.10, 8.8.29, 8.7.23
]]> Notice 54 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-54 camunda-security-notice-54 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-40984, where an unauthenticated attacker can send a specially crafted HTTP request to trigger uncontrolled resource consumption inside Micrometer's HTTP inst... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize Camunda Web Modeler The application was vulnerable to CVE-2026-40984, where an unauthenticated attacker can send a specially crafted HTTP request to trigger uncontrolled resource consumption inside Micrometer's HTTP instrumentation layer, rendering the affected component unresponsive until restarted.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22
  • Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.5, 8.8.14, 8.7.21
  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Camunda Optimize 8.9.10, 8.8.29, 8.7.23
  • Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23
]]> Notice 53 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-53 camunda-security-notice-53 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-11400, where a successful exploit grants the attacker elevated database privileges on Amazon Aurora PostgreSQL, potentially enabling unauthorized read/write ... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize Camunda Web Modeler The application was vulnerable to CVE-2026-11400, where a successful exploit grants the attacker elevated database privileges on Amazon Aurora PostgreSQL, potentially enabling unauthorized read/write access to all application data stored in the database.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.4
  • Camunda Zeebe ≤ 8.9.10
  • Camunda Tasklist ≤ 8.9.10
  • Camunda Operate ≤ 8.9.10
  • Camunda Optimize ≤ 8.9.10
  • Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

And your deployment is running on Amazon Aurora PostgreSQL with the AWS Advanced JDBC Wrapper configured to use the GlobalDatabasePlugin (for example, by setting wrapperPlugins=globaldb or equivalent in the JDBC connection URL). This is not the default Camunda configuration.

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.5
  • Camunda Zeebe 8.9.11
  • Camunda Tasklist 8.9.11
  • Camunda Operate 8.9.11
  • Camunda Optimize 8.9.11
  • Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23
]]> Notice 52 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-52 camunda-security-notice-52 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-47691, where an attacker controlling a subdomain's name server can provide crafted NS records to poison the DNS cache for parent domains, potentially redirec... Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Web Modeler The application was vulnerable to CVE-2026-47691, where an attacker controlling a subdomain's name server can provide crafted NS records to poison the DNS cache for parent domains, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.

How to determine if the installation is affected

You are using:

  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23
]]> Notice 51 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-51 camunda-security-notice-51 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-45674, where a remote attacker can achieve information disclosure or data manipulation by crafting malicious DNS responses. Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Web Modeler The application was vulnerable to CVE-2026-45674, where a remote attacker can achieve information disclosure or data manipulation by crafting malicious DNS responses.

How to determine if the installation is affected

You are using:

  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23
]]> Notice 50 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-50 camunda-security-notice-50 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-41842, where an attacker could send requests that are slow to resolve, keeping HTTP connections busy and potentially causing a Denial of Service. This is a D... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize The application was vulnerable to CVE-2026-41842, where an attacker could send requests that are slow to resolve, keeping HTTP connections busy and potentially causing a Denial of Service. This is a Denial of Service vulnerability in Spring MVC and WebFlux static resource resolution. The default Camunda configuration is not exploitable; the vulnerability requires both versioned resource resolution to be enabled (for example, by setting spring.web.resources.chain.strategy.content.enabled=true) and static resources to be served from the filesystem (for example, by setting spring.web.resources.static-locations=file:/...), neither of which is present in the default configuration.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22

And your deployment has versioned resource resolution enabled and static resources served from the filesystem.

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.5, 8.8.14, 8.7.21
  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Camunda Optimize 8.9.10, 8.8.29, 8.7.23
]]> Notice 49 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-49 camunda-security-notice-49 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-41841, where an attacker could gain access to a protected static resource if a resource with the same name had previously been resolved from a publicly acces... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize Camunda Web Modeler The application was vulnerable to CVE-2026-41841, where an attacker could gain access to a protected static resource if a resource with the same name had previously been resolved from a publicly accessible handler and cached server-side. This is an information disclosure vulnerability in Spring MVC and WebFlux static resource handling. The default Camunda configuration is not exploitable; the vulnerability requires server-side resource-chain caching to be enabled (for example, by setting spring.web.resources.chain.cache=true) and at least one resource handler that serves authentication-protected assets, neither of which is present in the default configuration.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22
  • Camunda Web Modeler ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

And your deployment has server-side resource-chain caching enabled with at least one access-controlled resource handler configured.

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.5, 8.8.14, 8.7.21
  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Camunda Optimize 8.9.10, 8.8.29, 8.7.23
  • Camunda Web Modeler 8.9.5, 8.8.16, 8.7.23
]]> Notice 48 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-48 camunda-security-notice-48 Wed, 13 May 2026 00:00:00 GMT The application was vulnerable to CVE-2026-42198, where an attacker with the privileges to impersonate or perform a man-in-the-middle (MITM) attack on the PostgreSQL server can force the JDBC driver t... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Web Modeler The application was vulnerable to CVE-2026-42198, where an attacker with the privileges to impersonate or perform a man-in-the-middle (MITM) attack on the PostgreSQL server can force the JDBC driver to perform SCRAM authentication with a very large iteration count. This can lead to high CPU usage inside the SCRAM PBKDF2 computation before authentication can fail. Web Modeler and Identity are affected by this CVE when run with their default configuration. Zeebe, Operate, and Tasklist are only affected in a self-managed setup when running the application with RDBMS as secondary storage with a PostgreSQL server configured as the endpoint.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.2, ≤ 8.8.11, or ≤ 8.7.18
  • Camunda Zeebe ≤ 8.9.2, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Tasklist ≤ 8.9.2, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Operate ≤ 8.9.2, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Web Modeler ≤ 8.9.2, ≤ 8.8.13, or ≤ 8.7.20

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.3, 8.8.12, 8.7.19
  • Camunda Zeebe 8.9.3, 8.8.24, 8.7.29
  • Camunda Tasklist 8.9.3, 8.8.24, 8.7.29
  • Camunda Operate 8.9.3, 8.8.24, 8.7.29
  • Camunda Web Modeler 8.9.3, 8.8.14, 8.7.21
]]> Notice 47 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-47 camunda-security-notice-47 Thu, 07 May 2026 00:00:00 GMT The application was vulnerable to CVE-2026-40973, where a local attacker could take control of the embedded Spring Boot ApplicationTemp directory. If server.servlet.session.persistent is set to true, ... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize Camunda Web Modeler The application was vulnerable to CVE-2026-40973, where a local attacker could take control of the embedded Spring Boot ApplicationTemp directory. If server.servlet.session.persistent is set to true, this could allow session hijacking or arbitrary code execution. Default Camunda 8 deployments are not affected.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.1, ≤ 8.8.11, or ≤ 8.7.18
  • Camunda Zeebe ≤ 8.9.1, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Tasklist ≤ 8.9.1, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Operate ≤ 8.9.1, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Optimize ≤ 8.9.1, ≤ 8.8.8, or ≤ 8.7.20
  • Camunda Web Modeler ≤ 8.9.1, ≤ 8.8.13, or ≤ 8.7.20

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.2, 8.8.12, 8.7.19
  • Camunda Zeebe 8.9.2, 8.8.24, 8.7.29
  • Camunda Tasklist 8.9.2, 8.8.24, 8.7.29
  • Camunda Operate 8.9.2, 8.8.24, 8.7.29
  • Camunda Optimize 8.9.2, 8.8.24, 8.7.21
  • Camunda Web Modeler 8.9.2, 8.8.14, 8.7.21
]]> Notice 46 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-46 camunda-security-notice-46 Thu, 07 May 2026 00:00:00 GMT The version of axios used by Camunda Web Modeler was affected by CVE-2026-42264, a prototype pollution vulnerability in the HTTP adapter that could allow credential injection and request hijacking whe... Camunda Web Modeler The version of axios used by Camunda Web Modeler was affected by CVE-2026-42264, a prototype pollution vulnerability in the HTTP adapter that could allow credential injection and request hijacking when Object.prototype is polluted by another dependency in the same process.

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.8.13, or ≤ 8.7.20

Solution

Camunda has provided the following releases that contain the fix:

  • Web Modeler Self-Managed 8.8.14, 8.7.21
]]> Notice 45 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-45 camunda-security-notice-45 Fri, 24 Apr 2026 00:00:00 GMT The application was vulnerable to CVE-2026-5588, where the PKIX CompositeVerifier in the embedded Bouncy Castle cryptography library could accept an empty signature sequence as valid, weakening certif... Camunda Tasklist Camunda Zeebe Camunda Operate The application was vulnerable to CVE-2026-5588, where the PKIX CompositeVerifier in the embedded Bouncy Castle cryptography library could accept an empty signature sequence as valid, weakening certificate signature verification and potentially allowing acceptance of improperly signed certificates.

How to determine if the installation is affected

You are using:

  • Camunda Tasklist 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
  • Camunda Zeebe 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
  • Camunda Operate 8.9.0, ≤ 8.8.22, or ≤ 8.7.27

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Tasklist 8.9.1, 8.8.23, 8.7.28
  • Camunda Zeebe 8.9.1, 8.8.23, 8.7.28
  • Camunda Operate 8.9.1, 8.8.23, 8.7.28
]]> Notice 44 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-44 camunda-security-notice-44 Fri, 24 Apr 2026 00:00:00 GMT The application was vulnerable to CVE-2025-14813, where the GOSTCTR implementation in the embedded Bouncy Castle cryptography library used an incorrect one-byte counter and could not securely encrypt ... Camunda Tasklist Camunda Zeebe Camunda Operate The application was vulnerable to CVE-2025-14813, where the GOSTCTR implementation in the embedded Bouncy Castle cryptography library used an incorrect one-byte counter and could not securely encrypt or decrypt more than 255 blocks, potentially compromising the confidentiality and integrity of data encrypted with this algorithm.

How to determine if the installation is affected

You are using:

  • Camunda Tasklist 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
  • Camunda Zeebe 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
  • Camunda Operate 8.9.0, ≤ 8.8.22, or ≤ 8.7.27

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Tasklist 8.9.1, 8.8.23, 8.7.28
  • Camunda Zeebe 8.9.1, 8.8.23, 8.7.28
  • Camunda Operate 8.9.1, 8.8.23, 8.7.28
]]> Notice 43 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-43 camunda-security-notice-43 Tue, 07 Apr 2026 00:00:00 GMT When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP headers will not be written. This is related to CVE-2026-22732. Management Identity Camunda Tasklist Camunda Zeebe Camunda Operate Camunda Optimize Camunda Web Modeler When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP headers will not be written. This is related to CVE-2026-22732.

How to determine if the installation is affected

You are using:

  • Management Identity 8.7.4 - 8.7.10, 8.7.12 - 8.7.16, 8.8.0 - 8.8.2, or 8.8.5 - 8.8.9
  • Zeebe 8.7.21 - 8.7.25
  • Tasklist 8.7.21 - 8.7.25
  • Operate 8.7.22 - 8.7.25
  • Optimize 8.7.14 - 8.7.18 or 8.8.2 - 8.8.7
  • Web Modeler Self-Managed ≤ 8.6.26, ≤ 8.7.18, or ≤ 8.8.11

Solution

Camunda has provided the following releases which contain the fix:

  • Management Identity 8.7.17, 8.8.10
  • Zeebe 8.7.26
  • Tasklist 8.7.26
  • Operate 8.7.26
  • Optimize 8.7.19, 8.8.8
  • Web Modeler Self-Managed 8.6.27, 8.7.19, 8.8.12

The fix was deployed to Web Modeler SaaS on March 23, 2026, 17:26 CET.

]]> Notice 42 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-42 camunda-security-notice-42 Mon, 09 Mar 2026 00:00:00 GMT The application was vulnerable to CVE-2026-24734, which allowed an attacker to bypass revocation checks of client SSL certificates if a certain server configuration was used. Management Identity The application was vulnerable to CVE-2026-24734, which allowed an attacker to bypass revocation checks of client SSL certificates if a certain server configuration was used.

How to determine if the installation is affected

You are using:

  • Management Identity ≤ 8.8.7, ≤ 8.7.14, or ≤ 8.6.27

Solution

Camunda has provided the following releases which contain the fix:

  • Management Identity 8.8.8, 8.7.15, 8.6.28
]]> Notice 41 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-41 camunda-security-notice-41 Mon, 09 Mar 2026 00:00:00 GMT The version of fast-xml-parser used by Camunda Web Modeler was affected by CVE-2026-26278, a vulnerability which could be exploited as a vector for denial of service attacks by forcing the parser to d... Camunda Web Modeler The version of fast-xml-parser used by Camunda Web Modeler was affected by CVE-2026-26278, a vulnerability which could be exploited as a vector for denial of service attacks by forcing the parser to do an unlimited amount of entity expansions.

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.8.8, ≤ 8.7.16, or ≤ 8.6.25

Solution

Camunda has provided the following releases that contain the fix:

  • Web Modeler Self-Managed 8.8.9, 8.7.17, 8.6.26

This issue does not affect Web Modeler SaaS.

]]> Notice 40 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-40 camunda-security-notice-40 Mon, 23 Feb 2026 00:00:00 GMT The version of Tomcat used by the Diagram Converter Webapp was affected by: C7 to C8 Migration Tooling The version of Tomcat used by the Diagram Converter Webapp was affected by:

How to determine if the installation is affected

You are using:

  • C7 to C8 Migration Tooling 0.2.0 AND
  • the Diagram Converter Webapp

Solution

Camunda has released the C7 to C8 Migration Tooling 0.2.1, which includes the fix.

]]> Notice 39 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-39 camunda-security-notice-39 Tue, 10 Feb 2026 00:00:00 GMT The version of fast-xml-parser used by Camunda Web Modeler was affected by CVE-2026-25128, a RangeError vulnerability that could crash any application that processes untrusted XML input. Camunda Web Modeler The version of fast-xml-parser used by Camunda Web Modeler was affected by CVE-2026-25128, a RangeError vulnerability that could crash any application that processes untrusted XML input.

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.8.6, ≤ 8.7.15, or ≤ 8.6.24

Solution

Camunda has provided the following releases that contain the fix:

  • Web Modeler Self-Managed 8.8.7, 8.7.16, 8.6.25

The fix was deployed to Web Modeler SaaS on February 2, 2026, 15:15 CET.

]]> Notice 38 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-38 camunda-security-notice-38 Thu, 08 Jan 2026 00:00:00 GMT The version of qs used by Camunda Web Modeler was affected by CVE-2025-15284, an improper input validation vulnerability that allows HTTP DoS. Camunda Web Modeler The version of qs used by Camunda Web Modeler was affected by CVE-2025-15284, an improper input validation vulnerability that allows HTTP DoS.

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.8.4, ≤ 8.7.14, or ≤ 8.6.23

Solution

Camunda has provided the following releases that contain the fix:

  • Web Modeler Self-Managed 8.8.5, 8.7.15, 8.6.24

The fix was deployed to Web Modeler SaaS on January 7, 2026, 13:45 CET.

]]> Notice 37 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-37 camunda-security-notice-37 Fri, 12 Dec 2025 00:00:00 GMT The application is vulnerable to CVE-2025-12183, which allows remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. Camunda Tasklist Camunda Zeebe Camunda Operate The application is vulnerable to CVE-2025-12183, which allows remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

How to determine if the installation is affected

You are using:

  • Tasklist/Zeebe/Operate ≤ 8.8.6, ≤ 8.7.20, or ≤ 8.6.32

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist/Zeebe/Operate 8.8.7, 8.7.21, 8.6.33
]]> Notice 36 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-36 camunda-security-notice-36 Wed, 03 Dec 2025 00:00:00 GMT The application is vulnerable to CVE-2025-53066, which allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalV... Management Identity The application is vulnerable to CVE-2025-53066, which allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.

How to determine if the installation is affected

You are using:

  • Management Identity ≤ 8.8.2, ≤ 8.7.10, or ≤ 8.6.22

Solution

Camunda has provided the following releases which contain the fix:

  • Management Identity 8.8.3, 8.7.11, 8.6.23
]]> Notice 35 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-35 camunda-security-notice-35 Wed, 26 Nov 2025 00:00:00 GMT The embedded JDBC driver for Amazon Aurora PostgreSQL (software.amazon.jdbc:aws-advanced-jdbc-wrapper) was affected by CVE-2025-12967, which may allow for privilege escalation to the rds_superuser rol... Camunda Web Modeler Self-Managed Camunda Management Identity The embedded JDBC driver for Amazon Aurora PostgreSQL (software.amazon.jdbc:aws-advanced-jdbc-wrapper) was affected by CVE-2025-12967, which may allow for privilege escalation to the rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.8.2, ≤ 8.7.12, or ≤ 8.6.21 with Amazon Aurora PostgreSQL
  • Management Identity ≤ 8.8.1, ≤ 8.7.9, or ≤ 8.6.21 with Amazon Aurora PostgreSQL

Solution

Camunda has provided the following releases which contain the fix:

  • Web Modeler Self-Managed 8.8.3, 8.7.13, 8.6.22
  • Management Identity 8.8.2, 8.7.10, 8.6.22
]]> Notice 34 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-34 camunda-security-notice-34 Tue, 11 Nov 2025 00:00:00 GMT The version of the MSSQL JDBC driver com.microsoft.sqlserver:mssql-jdbc used by Web Modeler was affected by CVE-2025-59250, which allows improper input validation that could enable an attacker to perf... Camunda Web Modeler Self-Managed The version of the MSSQL JDBC driver com.microsoft.sqlserver:mssql-jdbc used by Web Modeler was affected by CVE-2025-59250, which allows improper input validation that could enable an attacker to perform spoofing over a network.

How to determine if the installation is affected

You are using Web Modeler Self-Managed version <= 8.8.1 and Microsoft SQL Server as database vendor.

Solution

Camunda has provided the following release which contains the fix:

  • Web Modeler Self-Managed 8.8.2
]]> Notice 33 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-33 camunda-security-notice-33 Wed, 22 Oct 2025 00:00:00 GMT A bug in signal broadcast command processing allowed unauthorized users to trigger signal start events or signal intermediate catch events in certain process definitions without the required create or... Camunda Orchestration Cluster A bug in signal broadcast command processing allowed unauthorized users to trigger signal start events or signal intermediate catch events in certain process definitions without the required create or update permissions.

This did not allow users to access process definitions of other tenants, or leak any information about these process instances back to the unauthorized users.

How to determine if the installation is affected

You are using:

  • Orchestration Cluster 8.8.0

Solution

Camunda has provided the following release which contains the fix:

  • Orchestration Cluster 8.8.1
]]> Notice 32 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-32 camunda-security-notice-32 Tue, 21 Oct 2025 00:00:00 GMT The embedded Apache Tomcat was affected by CVE-2025-48989 which made Tomcat vulnerable to the MadeYouReset attack. Camunda Identity The embedded Apache Tomcat was affected by CVE-2025-48989 which made Tomcat vulnerable to the MadeYouReset attack.

How to determine if the installation is affected

You are using:

  • Identity 8.7.0 - 8.7.4 or 8.7.6 - 8.7.7

Solution

Camunda has provided the following release which contains the fix:

  • Identity 8.7.8
]]> Notice 31 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-31 camunda-security-notice-31 Thu, 16 Oct 2025 00:00:00 GMT The embedded Undertow web server was affected by CVE-2025-9784, a flaw where malformed client requests can trigger server-side stream resets without incrementing abuse counters. Camunda Web Modeler The embedded Undertow web server was affected by CVE-2025-9784, a flaw where malformed client requests can trigger server-side stream resets without incrementing abuse counters.

This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts and could be exploited to cause a denial of service (DoS).

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed 8.8.0, ≤ 8.7.10, or ≤ 8.6.19

Solution

Camunda has provided the following releases which contain the fix:

  • Web Modeler Self-Managed 8.8.1, 8.7.11, 8.6.20

The fix was deployed to Web Modeler SaaS on October 14, 2025, 14:26 CET.

]]> Notice 30 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-30 camunda-security-notice-30 Tue, 07 Oct 2025 00:00:00 GMT The embedded Netty was affected by CVE-2025-58056, an HTTP request smuggling vulnerability in Netty. Incorrect parsing of chunked transfer encoding could allow attackers to craft malicious requests th... Camunda Tasklist Camunda Zeebe Camunda Operate Camunda Optimize Camunda Identity The embedded Netty was affected by CVE-2025-58056, an HTTP request smuggling vulnerability in Netty. Incorrect parsing of chunked transfer encoding could allow attackers to craft malicious requests that are interpreted inconsistently by proxies and Netty.

How to determine if the installation is affected

You are using:

  • Tasklist 8.7.0 - 8.7.12 or 8.5.0 - 8.5.22
  • Zeebe 8.7.0 - 8.7.12 or 8.5.0 - 8.5.24
  • Operate 8.7.0 - 8.7.12 or 8.5.0 - 8.5.20
  • Optimize 8.7.0 - 8.7.9 or 8.6.0 - 8.6.16
  • Identity 8.7.0 - 8.7.6 or 8.6.0 - 8.6.19 or 8.5.0 - 8.5.21

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist 8.7.13, 8.5.23
  • Zeebe 8.7.13, 8.5.25
  • Operate 8.7.13, 8.5.21
  • Optimize 8.7.10, 8.6.17
  • Identity 8.7.7, 8.6.20, 8.5.22
]]> Notice 29 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-29 camunda-security-notice-29 Fri, 03 Oct 2025 00:00:00 GMT Zeebe may be affected by CVE-2024-41996, which allows remote attackers to trigger expensive server-side DHE modular-exponentiation calculations, potentially causing asymmetric resource consumption and... Camunda Zeebe Zeebe may be affected by CVE-2024-41996, which allows remote attackers to trigger expensive server-side DHE modular-exponentiation calculations, potentially causing asymmetric resource consumption and DoS attacks.

How to determine if the installation is affected

You are potentially affected if you have configured Zeebe to accept DHE or ECDHE cipher suites through the server.ssl.ciphers property or SERVER_SSL_CIPHERS environment variable.

Default Zeebe installations are not affected.

Solution

Configure the server.ssl.ciphers property or SERVER_SSL_CIPHERS environment variable to exclude DHE and ECDHE cipher suites. For example:

server.ssl.ciphers=TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA

There is no known mitigation other than disabling the use of DHE and ECDHE cipher suites.

]]> Notice 28 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-28 camunda-security-notice-28 Tue, 09 Sep 2025 00:00:00 GMT Optimize was affected by CVE-2025-5115, which allows a remote attacker to repeatedly send malformed HTTP/2 frames that exhaust a Jetty server’s CPU and memory, causing a denial-of-service. Camunda Optimize Optimize was affected by CVE-2025-5115, which allows a remote attacker to repeatedly send malformed HTTP/2 frames that exhaust a Jetty server’s CPU and memory, causing a denial-of-service.

How to determine if the installation is affected

You are using:

  • Optimize 8.7.0 - 8.7.8 or 8.6.0 - 8.6.15

Solution

Camunda has provided the following releases which contain the fix:

  • Optimize 8.7.9, 8.6.16
]]> Notice 27 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-27 camunda-security-notice-27 Wed, 27 Aug 2025 00:00:00 GMT Optimize's email functionality was affected by CVE-2025-7962, which allowed for SMTP injection by providing forged email recipient addresses that could lead to malicious content being sent to arbitrar... Camunda Optimize Optimize's email functionality was affected by CVE-2025-7962, which allowed for SMTP injection by providing forged email recipient addresses that could lead to malicious content being sent to arbitrary recipients.

How to determine if the installation is affected

You are using:

  • Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

  • Optimize 8.7.8, 8.6.15
]]> Notice 26 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-26 camunda-security-notice-26 Wed, 27 Aug 2025 00:00:00 GMT Optimize was affected by CVE-2025-53864 which allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. Camunda Optimize Optimize was affected by CVE-2025-53864 which allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion.

How to determine if the installation is affected

You are using:

  • Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

  • Optimize 8.7.8, 8.6.15
]]> Notice 25 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-25 camunda-security-notice-25 Wed, 27 Aug 2025 00:00:00 GMT The embedded Apache Tomcat was affected by CVE-2025-48989 which made Tomcat vulnerable to the MadeYouReset attack. Camunda Tasklist Camunda Zeebe Camunda Operate Camunda Optimize The embedded Apache Tomcat was affected by CVE-2025-48989 which made Tomcat vulnerable to the MadeYouReset attack.

How to determine if the installation is affected

You are using:

  • Tasklist 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.20
  • Zeebe 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24
  • Operate 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.18
  • Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist 8.7.11, 8.6.25, 8.5.21
  • Zeebe 8.7.11, 8.6.25
  • Operate 8.7.11, 8.6.25, 8.5.19
  • Optimize 8.7.8, 8.6.15
]]> Notice 24 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-24 camunda-security-notice-24 Wed, 27 Aug 2025 00:00:00 GMT The embedded Netty was affected by CVE-2025-55163 which allows malformed HTTP/2 control frames usage that results in resource exhaustion and distributed denial of service. Camunda Tasklist Camunda Zeebe Camunda Operate Camunda Identity Camunda Optimize The embedded Netty was affected by CVE-2025-55163 which allows malformed HTTP/2 control frames usage that results in resource exhaustion and distributed denial of service.

How to determine if the installation is affected

You are using:

  • Tasklist 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.20
  • Zeebe 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.22
  • Operate 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.18
  • Identity 8.7.0 - 8.7.5 or 8.6.0 - 8.6.18 or 8.5.0 - 8.5.19
  • Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist 8.7.11, 8.6.25, 8.5.21
  • Zeebe 8.7.11, 8.6.25, 8.5.23
  • Operate 8.7.11, 8.6.25, 8.5.19
  • Identity 8.7.6, 8.6.19, 8.5.20
  • Optimize 8.7.8, 8.6.15
]]> Notice 23 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-23 camunda-security-notice-23 Thu, 31 Jul 2025 00:00:00 GMT The embedded Spring Boot Tomcat was affected by CVE-2025-53506 which allowed for uncontrolled resource consumption that could be used to exhaust system resources in a potential DoS (denial of service)... Camunda Tasklist Camunda Zeebe Camunda Operate Camunda Identity Camunda Optimize The embedded Spring Boot Tomcat was affected by CVE-2025-53506 which allowed for uncontrolled resource consumption that could be used to exhaust system resources in a potential DoS (denial of service) attack.

How to determine if the installation is affected

You are using:

  • Tasklist 8.7.0 - 8.7.8 or 8.6.0 - 8.6.22 or 8.5.0 - 8.5.18
  • Zeebe 8.7.0 - 8.7.8 or 8.6.0 - 8.6.22
  • Operate 8.7.0 - 8.7.8 or 8.6.0 - 8.6.22 or 8.5.0 - 8.5.16
  • Identity 8.7.0 - 8.7.4 or 8.6.0 - 8.6.17 or 8.5.0 - 8.5.18
  • Optimize 8.7.0 - 8.7.6 or 8.6.0 - 8.6.12

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist 8.7.9, 8.6.23, 8.5.19
  • Zeebe 8.7.9, 8.6.23
  • Operate 8.7.9, 8.6.23, 8.5.17
  • Identity 8.7.5, 8.6.18, 8.5.19
  • Optimize 8.7.7, 8.6.13
]]> Notice 22 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-22 camunda-security-notice-22 Thu, 31 Jul 2025 00:00:00 GMT Part of our RESTful API that supported multipart file uploads was affected by CVE-2025-52520, which could lead to potential DoS (denial of service) attacks. Camunda Tasklist Camunda Zeebe Camunda Operate Part of our RESTful API that supported multipart file uploads was affected by CVE-2025-52520, which could lead to potential DoS (denial of service) attacks.

How to determine if the installation is affected

You are using:

  • Tasklist 8.6.0 - 8.6.22 or 8.7.0 - 8.7.8
  • Zeebe 8.6.0 - 8.6.22 or 8.7.0 - 8.7.8
  • Operate 8.6.0 - 8.6.22 or 8.7.0 - 8.7.8

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist 8.6.22
  • Tasklist 8.7.9
  • Zeebe 8.6.23
  • Zeebe 8.7.9
  • Operate 8.6.23
  • Operate 8.7.9
]]> Notice 21 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-21 camunda-security-notice-21 Wed, 18 Jun 2025 00:00:00 GMT The version of org.postgresql:postgresql used by Camunda Web Modeler Self-Managed was affected by CVE-2025-49146 potentially allowing a man-in-the-middle attacker to intercept connections when the Pos... Camunda Web Modeler Self-Managed The version of org.postgresql:postgresql used by Camunda Web Modeler Self-Managed was affected by CVE-2025-49146 potentially allowing a man-in-the-middle attacker to intercept connections when the PostgreSQL JDBC driver was configured with channel binding set to required.

How to determine if the installation is affected

You are using Camunda Web Modeler Self-Managed version 8.6.0 - 8.6.12, or 8.7.0 - 8.7.3.

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Web Modeler Self-Managed 8.6.12
  • Camunda Web Modeler Self-Managed 8.7.3
]]> Notice 20 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-20 camunda-security-notice-20 Tue, 17 Jun 2025 00:00:00 GMT Camunda Optimize was affected by a vulnerability that allowed an attacker to gain improper access to Optimize data by using a modified JWT (JSON Web Token). Camunda Optimize Camunda Optimize was affected by a vulnerability that allowed an attacker to gain improper access to Optimize data by using a modified JWT (JSON Web Token).

How to determine if the installation is affected

You are using Camunda Optimize ≤ 8.6.9 or ≤ 8.7.2.

Solution

Camunda has provided the following release which contains a fix:

]]> Notice 19 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-19 camunda-security-notice-19 Wed, 21 May 2025 00:00:00 GMT The version of nodejs used by Camunda Web Modeler was affected by CVE-2025-23166 potentially allowing an adversary to remotely crash the Node.js runtime. Camunda Web Modeler The version of nodejs used by Camunda Web Modeler was affected by CVE-2025-23166 potentially allowing an adversary to remotely crash the Node.js runtime.

How to determine if the installation is affected

You are using Camunda Web Modeler Self-Managed version ≤ 8.4.17, ≤ 8.5.18, ≤ 8.6.10, or ≤ 8.7.1.

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Web Modeler Self-Managed 8.4.18
  • Camunda Web Modeler Self-Managed 8.5.19
  • Camunda Web Modeler Self-Managed 8.6.11
  • Camunda Web Modeler Self-Managed 8.7.2

The fix was deployed to Web Modeler SaaS on May 19, 2025, 15:10 CET.

]]> Notice 18 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-18 camunda-security-notice-18 Tue, 08 Apr 2025 00:00:00 GMT Camunda Optimize was affected by a vulnerability that allowed an attacker to modify a JWT (JSON Web Token) so that they would be given improper access to Optimize. Camunda Optimize Camunda Optimize was affected by a vulnerability that allowed an attacker to modify a JWT (JSON Web Token) so that they would be given improper access to Optimize.

How to determine if the installation is affected

You are using Camunda Optimize ≤ 8.4.15, ≤ 8.5.12, ≤ 8.6.6, ≤ 8.7.0, ≤ 3.11.20, ≤ 3.12.15, ≤ 3.13.12, ≤ 3.14.3, ≤ 3.15.1.

Solution

Camunda has provided the following release which contains a fix:

  • Camunda Optimize 8.4.16, 8.5.13, 8.6.7, 8.7.0, 3.12.16, 3.13.13, 3.14.4, 3.15.2
]]> Notice 17 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-17 camunda-security-notice-17 Tue, 08 Apr 2025 00:00:00 GMT When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash. Camunda Zeebe When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.

  • As Zeebe makes extensive use of Protobuf, this could lead to denial-of-service (DoS) issues on the server side.
  • This issue allows an attacker to send specific payloads that will always result in StackOverflowException. This could lead to gateway performance issues and affect system availability.
  • Although the gateway will not crash, it will spend more time working on these requests. An attacker could use this opportunity to slow it down and make it unusable by sending a large number of requests within a short time frame.

No data is leaked, lost, or corrupted. This issue only affects application availability.

Learn more about this CVE at the GitHub Advisory Database.

How to determine if the installation is affected

You are using Camunda Zeebe 8.6.11.

Solution

Camunda has provided the following release which contains a fix:

]]> Notice 16 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-16 camunda-security-notice-16 Fri, 14 Mar 2025 00:00:00 GMT Some Camunda Zeebe versions were affected by a vulnerability that allowed a malicious attacker to craft network packets that could crash the gateway. Camunda Zeebe Some Camunda Zeebe versions were affected by a vulnerability that allowed a malicious attacker to craft network packets that could crash the gateway.

How to determine if the installation is affected

You are using Camunda Zeebe 8.6.0 - 8.6.11

Solution

Camunda has provided the following release which contains a fix:

]]> Notice 15 https://unsupported.docs.camunda.io/8.7/docs/reference/notices/#notice-15 camunda-security-notice-15 Tue, 11 Mar 2025 00:00:00 GMT Some Camunda Optimize versions were affected by a vulnerability that allowed a malicious attacker to craft Camunda URLs that could execute JavaScript code. Camunda Optimize Some Camunda Optimize versions were affected by a vulnerability that allowed a malicious attacker to craft Camunda URLs that could execute JavaScript code.

How to determine if the installation is affected

You are using Camunda Optimize ≤ 8.6.5.

Solution

Camunda has provided the following release which contains a fix:

]]>