Security notices

Read the latest Camunda security notices published after fixes are made available.

Subscribe to security notices

Subscribe to the RSS feed for security updates and get automatic notifications when new security notices are published.

Report a security issue or vulnerability

Report security vulnerabilities to Camunda immediately, following the instructions at Camunda Security.

info

To learn more about security at Camunda, including our security policy, security issue management, and more, see Camunda.com/security.

Understand affected and fixed versions

Each security notice lists affected and fixed versions by Camunda component (for example, Zeebe, Operate, Tasklist, Identity, Optimize, and Hub), not by Helm chart version. The Helm chart has its own version, tracked separately from the component versions it deploys.

For Camunda 8.8 and later, the Orchestration Cluster unifies Zeebe, Operate, and Tasklist, so these components share the same version number.

To check whether your Helm deployment is affected:

1. Identify the Helm chart version you are running.
2. In the Helm chart version matrix, find the component versions that the chart deploys.
3. Compare those component versions with the affected and fixed versions listed in the notice.

Notice 80

Publication date

November 4, 2026

Products affected

• Camunda Orchestration Cluster (Zeebe, Operate, Tasklist)
• Camunda Zeebe, Operate, and Tasklist (8.7)
• Camunda Zeebe (8.6)
• Camunda Optimize
• Camunda Management Identity (Identity in 8.6)
• Camunda Connectors
• Hub Self-Managed 8.10
• Web Modeler Self-Managed 8.6, 8.7, 8.8, and 8.9
• Console Self-Managed 8.7, 8.8, and 8.9
• Camunda Keycloak images (camunda/keycloak and registry.camunda.cloud/keycloak-ee/keycloak)

Impact

The certificate authority eMudhra reported that an attacker compromised some of its intermediate certificate authorities. Oracle published two Java security alerts for this compromise:

• CVE-2026-91403 removes the root certificates "emSign ECC Root CA - G3" and "AAA Certificate Services" from the Java trust store.
• CVE-2026-114820 also removes "emSign Root CA - G1" and "emSign Root CA - G2".

Severity: Critical (CVSS 9.1, CVE-2026-114820).

The trust stores in the affected images contain some of these root certificates.

Exploitation requires an attacker who also controls the network path, for example through DNS poisoning or a compromised network device. The attacker can then do a man-in-the-middle attack on outgoing TLS connections from Camunda components, with a certificate that a compromised intermediate signed.

We have no evidence that an attacker used this against Camunda. This issue does not affect Camunda keys and secrets. No public Camunda endpoint uses an eMudhra certificate. If you suspect a man-in-the-middle attack on an outgoing connection, rotate the credentials that this connection sends.

How to determine if the installation is affected

You are using:

• Camunda Orchestration Cluster ≤ 8.10.5, ≤ 8.9.25, or ≤ 8.8.43
• Camunda Zeebe, Operate, or Tasklist ≤ 8.7.43
• Camunda Zeebe ≤ 8.6.40
• Camunda Optimize ≤ 8.10.5, ≤ 8.9.25, ≤ 8.8.43, or ≤ 8.7.29
• Camunda Connectors ≤ 8.10.1, ≤ 8.9.16, ≤ 8.8.23, ≤ 8.7.29, or ≤ 8.6.33
• Camunda Management Identity ≤ 8.10.1, ≤ 8.9.11, ≤ 8.8.19, or ≤ 8.7.26
• Camunda Identity ≤ 8.6.33
• Hub Self-Managed ≤ 8.10.4
• Web Modeler Self-Managed ≤ 8.9.13 or ≤ 8.8.24, or any 8.6 or 8.7 version
• Console Self-Managed ≤ 8.9.129, ≤ 8.8.146, or ≤ 8.7.114
• A Camunda Keycloak image built before October 22, 2026, or a Camunda Keycloak image for Keycloak 23, 24, or 25

To see when an image was built, run docker inspect -f '{{.Created}}' <image>.

Solution

Camunda has provided the following releases which contain the fix for CVE-2026-91403 ("emSign ECC Root CA - G3" and "AAA Certificate Services" are removed from the trust stores):

• Camunda Orchestration Cluster 8.10.6, 8.9.26, 8.8.44
• Camunda Zeebe, Operate, and Tasklist 8.7.44
• Camunda Zeebe 8.6.41
• Camunda Optimize 8.10.6, 8.9.26, 8.8.44, 8.7.30
• Camunda Connectors 8.10.2, 8.9.17, 8.8.24, 8.7.30, 8.6.34
• Camunda Management Identity 8.10.2, 8.9.12, 8.8.20, 8.7.27
• Hub Self-Managed 8.10.5
• Web Modeler Self-Managed 8.9.14, 8.8.25
• Camunda Identity 8.6.34
• Console Self-Managed 8.9.130, 8.8.147, 8.7.115
• Camunda Keycloak images built on or after October 22, 2026:
  • camunda/keycloak with the 26.3.3 tag. This is the default image of the bundled identityKeycloak subchart in Camunda 8.7 to 8.9. This tag receives no more updates. For details, see Keycloak support, security fixes, and upgrades.
  • camunda/keycloak with the quay-26.8.1, quay-optimized-26.8.1, or latest tag
  • registry.camunda.cloud/keycloak-ee/keycloak with the 26.8.1 tag, which values-enterprise.yaml uses in Camunda 8.7 to 8.9

If you use one of these Keycloak tags, pull the image again and restart Keycloak. With imagePullPolicy: IfNotPresent or a mirrored registry, the old image can stay in use. Update your mirror and make sure that the new image runs.

The base images for Keycloak 23, 24, and 25 receive no more updates, so these Camunda Keycloak images do not get the fix. If you use Keycloak 23, 24, or 25, upgrade to a fixed Keycloak 26 image. Refer to Prepare a Keycloak upgrade.

The releases above still trust "emSign Root CA - G1", which CVE-2026-114820 also removes. Eclipse Temurin and Mozilla keep this root because it is not related to the compromised intermediates. To follow CVE-2026-114820, remove it with the workaround below. We will update this notice when we release images without it.

A fix for Web Modeler Self-Managed 8.6 and 8.7 is not available yet. Their REST API images still trust the root certificates. Use the workaround below. We will update this notice when we release the fix. Camunda Operate, Tasklist, and Optimize 8.6 are not affected. Their images use a trust store that does not contain the root certificates.

If you can't upgrade immediately, remove the four root certificates from the Java truststore of the Camunda Java components that the Helm chart deploys. For step-by-step instructions, see Remove a CA from the JVM truststore. This procedure does not cover Keycloak or Console. For Camunda 8.6 and 8.7, contact Camunda Support for the workaround procedure.

On Camunda 8 SaaS, if you disabled the automatic upgrade of your clusters, we recommend that you update them to the latest available patch version.

Notice 79

Publication date

November 2, 2026

Products affected

• Zeebe
• Operate
• Tasklist
• Optimize

Impact

CVE-2026-71290 is a TLS hostname verification bypass in the asynchronous client of Apache HttpClient 5 (httpclient5 5.4 through 5.6.3). Camunda uses this client to connect to Elasticsearch and OpenSearch. An attacker in a network position to intercept traffic (for example, through DNS spoofing or a compromised host on a shared network segment) can impersonate the search backend with a valid certificate for another domain. This can expose Basic authentication credentials sent to the backend, expose or modify process data in transit, and allow forged responses.

This notice covers the 8.6 line. For the 8.7 fixes, see Notice 60.

How to determine if the installation is affected

You are using one of the following components, and it connects to Elasticsearch or OpenSearch over TLS:

• Zeebe, Operate, or Tasklist ≤ 8.6.39
• Optimize ≤ 8.6.27

Solution

Camunda has provided the following releases which contain the fix:

• Zeebe, Operate, Tasklist: 8.6.40
• Optimize: 8.6.28

Notice 78

Publication date

November 2, 2026

Products affected

Identity

Impact

CVE-2026-68763 is an uncontrolled resource consumption flaw in Apache Tomcat. A memory leak occurs in the HTTP/2 handling when a client resets a stream.

Identity enables HTTP/2 by default, so an attacker who can reach its HTTP port can exhaust memory and cause a denial of service without authenticating. The flaw does not allow reading or changing data. Because Identity is central to multi-tenancy, an outage can disrupt the wider automation stack.

How to determine if the installation is affected

You are using Identity before 8.6.34, with the default server.http2.enabled: true, and the Identity port is reachable by untrusted clients.

Solution

Camunda has provided the following releases which contain the fix:

• Identity: 8.6.34 (included in the Camunda 8.6.41 Docker image)

As a workaround, set server.http2.enabled to false.

Notice 77

Publication date

November 2, 2026

Products affected

Operate, Tasklist

Impact

CVE-2026-41720 is a flaw in Spring LDAP: bind requests with a non-empty username and an empty or null password are not rejected. In Operate or Tasklist with legacy LDAP authentication enabled (ldap-auth profile), an attacker who knows a valid username may authenticate with a blank password and gain access to the web application, if the LDAP directory accepts such binds. Other deployments are not affected.

How to determine if the installation is affected

You are using Operate or Tasklist with the ldap-auth profile enabled, before 8.6.40.

Solution

Camunda has provided the following releases which contain the fix:

• Operate, Tasklist: 8.6.40

As a workaround, configure your LDAP server to reject unauthenticated (empty-password) binds.

Notice 76

Publication date

November 2, 2026

Products affected

Zeebe, Operate, Tasklist, Identity, and Optimize

Impact

CVE-2026-40984 is a denial of service in Micrometer's HTTP request instrumentation. Spring Boot applies it automatically to all HTTP endpoints. An unauthenticated attacker who can reach any HTTP endpoint can send a specially crafted request that drives the instrumentation into excessive resource use, making the component unresponsive until restart. This affects availability only; it does not expose or modify data.

How to determine if the installation is affected

You are using one of the following components with HTTP endpoints reachable by untrusted clients:

• Zeebe, Operate, Tasklist before 8.6.40
• Identity before 8.6.31
• Optimize before 8.6.27

Solution

Camunda has provided the following releases which contain the fix:

• Zeebe, Operate, Tasklist: 8.6.40
• Identity: 8.6.31
• Optimize: 8.6.27

Notice 75

Publication date

November 2, 2026

Products affected

Zeebe

Impact

CVE-2026-40983 is a denial of service in Micrometer's gRPC server instrumentation. The Zeebe Gateway applies this interceptor to its public gRPC API with no way to disable it. An unauthenticated attacker with network access can send crafted gRPC requests and exhaust resources, making the gateway unresponsive until it is restarted. All client operations (job polling, deployments, message publication, and process instance creation) are interrupted. Operate, Tasklist, and Identity include the library but do not run a gRPC server, so they are not exploitable.

How to determine if the installation is affected

You are using Zeebe before 8.6.40, with the gateway endpoint reachable by untrusted clients.

Solution

Camunda has provided the following releases which contain the fix:

• Zeebe: 8.6.40

Notice 74

Publication date

November 2, 2026

Products affected

Zeebe

Impact

CVE-2026-42587 is a decompression limit bypass in Netty. The maxAllocation limit is not enforced when the content encoding is Brotli, zstd, or Snappy. An unauthenticated attacker can send a small compressed payload that causes unbounded memory allocation. This leads to an out-of-memory denial of service on the Zeebe Gateway, whose Netty HTTP/2 endpoint is reachable from outside the cluster. Other components have a much lower likelihood. Data is not disclosed or modified.

How to determine if the installation is affected

You are using Zeebe before 8.6.40, with the gateway endpoint reachable by untrusted clients.

Solution

Camunda has provided the following releases which contain the fix:

• Zeebe: 8.6.40

Notice 73

Publication date

November 2, 2026

Products affected

Zeebe, Operate, Tasklist, Identity, and Optimize

Impact

CVE-2026-42585 is an HTTP request smuggling flaw in Netty. It comes from incorrect parsing of malformed Transfer-Encoding headers. If an affected component sits behind a reverse proxy, load balancer, or Ingress that parses the request boundary differently, an attacker can smuggle a second request past front-end checks such as authentication or WAF rules. Depending on the setup, this can lead to unauthorized access to protected endpoints, cache poisoning, or session abuse. HTTPS does not prevent it.

How to determine if the installation is affected

You are using the following components behind a reverse proxy, load balancer, or Ingress:

• Zeebe, Operate, Tasklist before 8.6.40
• Identity before 8.6.31
• Optimize before 8.6.27

Solution

Camunda has provided the following releases which contain the fix:

• Zeebe, Operate, Tasklist: 8.6.40
• Identity: 8.6.31
• Optimize: 8.6.27

Notice 72

Publication date

November 2, 2026

Products affected

Operate, Tasklist, and Zeebe Java Client (io.camunda:zeebe-client-java)

Impact

CVE-2026-68494 is an incomplete fix for a number-length limit bypass in the non-blocking parser of jackson-core. The Zeebe Java Client (io.camunda:zeebe-client-java) uses that parser to read chunked API responses. Operate and Tasklist use the Zeebe Java Client and can be affected transitively. A malicious or compromised response could make the client process hang or run out of memory.

How to determine if the installation is affected

You are using:

• Operate or Tasklist before 8.6.40, because these components use the affected Zeebe Java Client dependency
• Zeebe Java Client (io.camunda:zeebe-client-java) before 8.6.40 with a jackson-core version in the affected range, connecting to an endpoint you do not fully trust

Solution

Camunda has provided the following releases which contain the fix:

• Operate, Tasklist, and Zeebe Java Client (io.camunda:zeebe-client-java): 8.6.40

Notice 71

Publication date

November 2, 2026

Products affected

Zeebe, Operate, Tasklist, Identity, and Optimize

Impact

CVE-2026-34282 is a flaw in the networking component of the Oracle JDK shipped in Camunda container images (OpenJDK 21.0.10). A TLS peer can cause a blocking network call to hang indefinitely, which pins the handling thread. Enough requests can exhaust the web server's thread pool and make the component unresponsive to all users (denial of service).

Exploitation has strong preconditions. The component must run with OpenID Connect (OIDC) authentication against an identity provider reached over HTTPS, and the attacker must control or sit on the path to that identity provider. Confidentiality and integrity are not affected.

How to determine if the installation is affected

You are using:

• Zeebe, Operate, Tasklist before 8.6.40
• Identity before 8.6.31
• Optimize before 8.6.27

Solution

Camunda has provided the following releases which contain the fix:

• Zeebe, Operate, Tasklist: 8.6.40
• Identity: 8.6.31
• Optimize: 8.6.27

Notice 70

Publication date

October 26, 2026

Products affected

• Camunda Web Modeler

Impact

Web Modeler Self-Managed is affected by CVE-2026-111497, a critical-severity out-of-bounds write in the Node.js Brotli decoder that can allow remote code execution.

The Web Modeler Self-Managed 8.7 and 8.8 webapp images contain a Node.js runtime. An authenticated Web Modeler user can reach the affected decoder through the "import resources from URL" capability: the webapp server fetches URLs that the user supplies and automatically decodes Brotli-compressed responses. A server controlled by an attacker can return a crafted Brotli response that triggers the out-of-bounds write in the Node.js process.

How to determine if the installation is affected

You are using:

• Web Modeler Self-Managed ≤ 8.7.27, or ≤ 8.8.23

Solution

Camunda has provided the following releases which contain the fix (Node.js 24.22.1):

• Web Modeler Self-Managed 8.7.28, 8.8.24

No action is necessary for Camunda SaaS.

Notice 69

Publication date

October 26, 2026

Products affected

• Hub Self-Managed 8.10
• Web Modeler Self-Managed 8.7, 8.8, and 8.9

Impact

Two critical vulnerabilities in PHP (CVE-2026-109618 and CVE-2026-109619) were disclosed on 20 October 2026. Our security and engineering teams have analyzed both in detail. We found no way to exploit them in any Camunda product. Out of an abundance of caution, we have released updated images with the fixed PHP version.

Which products are concerned

• SaaS: Camunda SaaS does not use PHP and is not affected.
• Self-Managed: The websockets component of Hub (version ≤ 8.10.3) and Web Modeler (versions ≤ 8.9.12, ≤ 8.8.23, or ≤ 8.7.27) runs PHP 8.5.11, a version in the affected range.
• No other Camunda 8 component uses PHP.

Why the vulnerabilities cannot be exploited

Both vulnerabilities are in the way PHP processes incoming web requests when it runs inside a web server (for example PHP-FPM or Apache with mod_php). The websockets component does not run PHP that way. It runs as a standalone process that reads and validates requests itself, never uses PHP's request handling, and accepts only small, size-limited messages. None of the attack paths described in the CVE advisories can reach it.

What you need to do

No immediate action is required. We recommend updating to the new images as part of your normal update process.

If your own policy requires it, you can stop the websockets component until you have updated. Web Modeler and Hub keep working, and all modeling, saving, deployment, versioning and Git sync functionality is unaffected. Only features that rely on real-time updates are affected while the component is stopped.

• Real-time collaboration: online presence, live diagram updates, live comments, attention markers and live changes to project permissions are not delivered. Collaborators see each other's changes only after reloading the page, concurrent changes might conflict / overwrite each other.
• AI copilot (8.8 and later): copilot responses are delivered through the websockets component and are not returned while it is stopped.
• Intelligent Document Processing (8.8 and later): extraction results are delivered through the websockets component and are not shown in the modeler while it is stopped.

How to determine if the installation is affected

You are using:

• Hub ≤ 8.10.3
• Web Modeler ≤ 8.9.12, ≤ 8.8.23, or ≤ 8.7.27

Solution

Camunda has provided the following releases which contain the fix (update to PHP 8.5.12):

• Hub 8.10.4
• Web Modeler 8.9.13, 8.8.24, 8.7.28

Notice 68

Publication date

October 20, 2026

Products affected

• Management Identity Self-Managed 8.8, 8.9, and 8.10
• Orchestration Cluster 8.9 and 8.10, when PostgreSQL is used as secondary storage (RDBMS)
• Web Modeler Self-Managed 8.8 and 8.9, when PostgreSQL is used as RDBMS
• Hub Self-Managed 8.10, when PostgreSQL is used as RDBMS

Impact

The PostgreSQL JDBC driver (org.postgresql:postgresql) versions 42.7.11 to 42.7.13 used by Camunda are affected by CVE-2026-107314. If the requireAuth connection property excludes every authentication method, or lists no method at all, the driver doesn't restrict the authentication method. A man-in-the-middle attacker between Camunda and PostgreSQL can then request cleartext password authentication and obtain the database password.

The following values trigger the issue:

• requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none (excludes every method)
• requireAuth=, (lists no method)

Severity: High. The upstream CVSS 3.1 base score for the library is 5.9 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

The requireAuth property has no default value, and Camunda doesn't set it. Only installations that set the property as described are affected.

How to determine if the installation is affected

Your installation is affected if all of these conditions are true:

• You run one of the following Camunda products on a version earlier than the fixed versions listed in the solution:
  • Management Identity 8.8 to 8.10
  • Orchestration Cluster 8.9 or 8.10 with PostgreSQL as secondary storage
  • Web Modeler 8.8 or 8.9 with PostgreSQL
  • Hub 8.10 with PostgreSQL
• The JDBC URL or datasource properties for the PostgreSQL connection set requireAuth to a value that excludes all authentication methods, or that contains no method.
• The database connection doesn't use TLS with full server verification (sslmode=verify-full).

Solution

Camunda has provided the following releases which contain the fix (driver version 42.7.14):

• Orchestration Cluster: 8.10.4, 8.9.24
• Management Identity: 8.10.1, 8.9.11, 8.8.19
• Web Modeler: 8.9.11, 8.8.22
• Hub: 8.10.3

If your configuration sets requireAuth to one of the affected values, replace it with a positive list of the authentication methods your PostgreSQL server uses, for example requireAuth=scram-sha-256, before you upgrade. After the upgrade, the driver refuses connections that use a value excluding every method (SQLState 08004), and rejects a value that lists no method as invalid (SQLState 22023).

If you can't upgrade immediately, use one of these workarounds:

• Replace the requireAuth value with a positive list of allowed methods on your current version, as described above.
• Connect to PostgreSQL with sslmode=verify-full.

Notice 67

Publication date

October 9, 2026

Products affected

• Camunda Helm chart for Camunda 8.7, 8.8, and 8.9, when the bundled Keycloak subchart (identityKeycloak) uses the default Community Edition image

Impact

Keycloak is affected by CVE-2026-18963, a flaw in the reset-credentials flow. An unauthenticated attacker can force a password reset for any user without the email verification step, set new credentials, and take over the account, including administrator accounts.

Severity: Critical (CVSS 9.1).

The bundled Keycloak subchart in the Camunda 8.7, 8.8, and 8.9 Helm charts defaults to the Community Edition image camunda/keycloak:26.3.3. This image is based on the Bitnami Keycloak image, which Bitnami no longer updates. As a result, Camunda cannot publish a fixed image on this line, and the image will not receive this or any future fix.

Camunda SaaS is not affected.

How to determine if the installation is affected

The following Keycloak versions are affected:

• ≥ 26.0.0, < 26.4.15
• ≥ 26.5.0, < 26.6.6
• ≥ 26.7.0, < 26.7.2

Your installation is affected if all of these conditions are true:

• You deploy Camunda 8.7, 8.8, or 8.9 with the Camunda Helm chart, and the bundled Keycloak subchart is enabled (identityKeycloak.enabled: true).
• You use the default camunda/keycloak image (tag 26.3.3, any 26.3.3-* rebuild tag, or the bitnami-* and latest-bitnami tags), or another Keycloak image with an affected version.

Camunda Helm chart 12.13.6 (Camunda 8.7), 13.13.2 (Camunda 8.8), 14.10.1 (Camunda 8.9), and later show a security warning when the rendered Keycloak image is affected.

If you run Keycloak outside the Camunda Helm chart, your installation is affected if your Keycloak version is in one of the affected ranges.

The Camunda 8.10 Helm chart does not include a bundled Keycloak subchart and is not affected. If you use your own Keycloak with Camunda 8.10, check your Keycloak version as described above.

Solution

The following Keycloak versions contain the fix:

• 26.4.15
• 26.6.6
• 26.7.2

Camunda does not provide a fixed Community Edition image for the bundled Keycloak subchart. Use one of these options:

• Use the Camunda enterprise images: Enterprise customers can switch to the Bitnami Premium images provided by Camunda. The enterprise Keycloak image registry.camunda.cloud/keycloak-ee/keycloak receives security updates and contains the fix from version 26.7.2. Camunda Helm chart 12.13.4 (Camunda 8.7), 13.12.8 (Camunda 8.8), 14.8.5 (Camunda 8.9), and later use a fixed Keycloak version in values-enterprise.yaml.
• Migrate away from the bundled Keycloak subchart: Replace the bundled Keycloak with the Keycloak Operator, a managed service, or another maintained Keycloak deployment that runs a fixed version. For step-by-step instructions, see migrate from Bitnami subcharts.

After you apply the fix, examine Keycloak events and user accounts for password resets that you do not expect, and reset the credentials of any affected accounts.

No action is necessary for Camunda SaaS.

Notice 66

Publication date

October 7, 2026

Products affected

• Camunda Optimize Self-Managed

Impact

The Docker images camunda/optimize:8.10.0 and camunda/optimize:8.10.1 were available for a short time before the Camunda 8.10 release announcement. These images contain a defect in the Optimize access check. In Self-Managed installations that use Management Identity, users without the Optimize permission can get access to Optimize. This includes read access to Optimize data, and changes to Optimize entities such as reports and dashboards.

Exploitation requires a user who can log in to the identity provider that Optimize uses. Unauthenticated access is not possible.

We removed the affected images from Docker Hub. No official Camunda Helm chart release referenced these images. Camunda SaaS is not affected.

How to determine if the installation is affected

Your installation is affected if all of these conditions are true:

• You run Camunda Optimize Self-Managed with the image camunda/optimize:8.10.0 or camunda/optimize:8.10.1. This includes images with these tags that you copied to your own registry. If you install with an official Camunda Helm chart release and do not override the Optimize image, you do not use these images.
• Optimize uses Management Identity for authentication.

Optimize 8.9 and earlier versions are not affected.

Solution

Upgrade Optimize to version 8.10.2 immediately. Optimize 8.10.2 contains the fix.

If you used the image camunda/optimize:8.10.0 or camunda/optimize:8.10.1:

1. Upgrade to camunda/optimize:8.10.2.
2. Remove the affected images from your private registries and image caches.
3. Examine the Optimize data, for example reports, dashboards and collections, for changes that you do not expect.

No action is necessary for Camunda SaaS.

Notice 65

Publication date

October 7, 2026

Products affected

• Camunda Orchestration Cluster (Zeebe, Operate, Tasklist)
• Camunda Zeebe (8.7)

Impact

The document endpoint of the Orchestration Cluster REST API rendered uploaded document content in the browser instead of downloading it. A user allowed to upload documents could use this to run scripts in the application's origin with the privileges of another user who opens the document, including administrators.

Severity: High.

How to determine if the installation is affected

You are using:

• Camunda Orchestration Cluster ≤ 8.9.22 or ≤ 8.8.40
• Camunda Zeebe ≤ 8.7.42

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Orchestration Cluster 8.10.0, 8.9.23, 8.8.41
• Camunda Zeebe 8.7.43

The document endpoint now serves all document content with a Content-Security-Policy: sandbox header, and returns documents as downloads (Content-Disposition: attachment), except for PDF files and images, which are still displayed in the browser.

On Camunda 8 SaaS, this fix is included automatically unless you've opted out of auto-updates, in which case you'll need to update your cluster manually.

Notice 64

Publication date

September 21, 2026

Products affected

• Camunda Orchestration Cluster (Zeebe, Operate, Tasklist)
• Camunda Connectors
• Camunda Web Modeler

Impact

A remote code execution vulnerability was identified in Camunda's FEEL expression engine allowing execution of arbitrary code within the scope of a Camunda 8 server operating system process.

Severity: Critical 9.9 (CVSS v3.1: AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

This vulnerability was identified by Camunda's Security Team, with no known report or exploit beyond our own security investigation. A CVE identifier has been requested and this notice will be updated once it is assigned. For further details, see GHSA-vx3p-v6cf-vfjw.

How to determine if the installation is affected

You are using:

• Camunda Orchestration Cluster ≤ 8.9.19 or ≤ 8.8.37
• Camunda Zeebe, Operate, or Tasklist ≤ 8.7.39
• Camunda Connectors ≤ 8.9.10, ≤ 8.8.19, or ≤ 8.7.25
• Web Modeler ≤ 8.9.8, or ≤ 8.8.19

Any component that bundles org.camunda.feel:feel-engine up to and including 1.22.0 is affected. Versions older than the ones listed above, including versions that have reached end of maintenance, are also affected, with the exception of Web Modeler, where versions below 8.8.0 are not affected.

Exploitation requires one of the following:

• The attacker is an authenticated and authorized user of the Camunda Orchestration Cluster REST API 8.9+ who has the privilege to invoke the Evaluate Expression API. The authorization requires:
  • Permission granted to user or client (directly or via role)
  • Resource type: EXPRESSION
  • Permission: EVALUATE
  • By default, this permission is granted as part of the admin role
• The attacker is an authenticated and authorized user who has the privilege to deploy BPMN or DMN to the Camunda Orchestration Cluster:
  • Prior to 8.8: API access (gRPC or REST)
  • Starting 8.8: via gRPC or REST
  • The authorization requires:
    • Permission granted to user or client (directly or via role)
    • Resource type: Resource
    • Permission: CREATE
    • By default, this permission is granted as part of the admin role
• The attacker is an authenticated and authorized user of Camunda Web Modeler ≤ 8.9.8 or ≤ 8.8.19

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Orchestration Cluster 8.9.21, 8.8.39
• Camunda Zeebe, Operate, Tasklist 8.7.41
• Camunda Connectors 8.9.12, 8.8.21, 8.7.27
• Web Modeler Self-Managed 8.9.9, 8.8.20

These releases bundle a patched FEEL engine (1.22.1, 1.21.1, 1.20.3, 1.19.6, 1.18.6, 1.17.13, 1.16.6, or 1.15.5, depending on the component). If you embed the FEEL engine directly, upgrade org.camunda.feel:feel-engine to the patched version of your 1.x line.

Camunda 8 SaaS was fully remediated on September 12 and 13, 2026, ahead of this notice. All clusters across all supported versions, and Web Modeler SaaS, were updated to patched builds; no action is required on your part. Clusters that were suspended at that time receive the patched version when they resume.

Notice 63

Publication date

September 21, 2026

Products affected

• Camunda Optimize

Impact

The application was vulnerable to the following vulnerabilities in the embedded Eclipse Jetty web server:

• CVE-2026-19203, where a flaw in HTTP/1.1 chunked request parsing accepts a lone line feed (LF) character as a terminator in parts of chunked requests. When deployed behind an intermediary reverse proxy that requires strict CRLF delimiters, this discrepancy in request boundary interpretation can lead to HTTP request smuggling.
• CVE-2026-12611, where a race condition in the HTTP/2 server implementation when handling concurrent RST_STREAM and GOAWAY frames from a client can cause write-blocked threads to never be unblocked, potentially leading to thread exhaustion and a Denial of Service. The default Camunda Optimize configuration is not exploitable; this vulnerability only applies when HTTP/2 support is explicitly enabled (container.http2Enabled: true).

How to determine if the installation is affected

You are using:

• Camunda Optimize ≤ 8.7.27

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Optimize 8.7.28

Notice 62

Publication date

September 8, 2026

Products affected

• Camunda Web Modeler

Impact

The application was vulnerable to CVE-2026-75140 in jsoup's XmlTreeBuilder which could allow an attacker to exhaust JVM heap memory by supplying a deeply nested XML document (in this case a BPMN or DMN diagram) with uniquely-namespaced elements.

How to determine if the installation is affected

You are using:

• Web Modeler Self-Managed ≤ 8.9.7, ≤ 8.8.18, or ≤ 8.7.25

Solution

Camunda has provided the following releases that contain the fix:

• Web Modeler Self-Managed 8.9.8, 8.8.19, 8.7.26

The fix was deployed to Web Modeler SaaS on August 29, 2026, 10:35 CET.

Notice 61

Publication date

September 8, 2026

Products affected

• Camunda Connectors

Impact

The connector runtime resolves a secret reference (for example, {{secrets.MY_API_KEY}}) wherever that literal text appears in a connector's input, without restricting resolution to the field where the reference was declared. Under the following conditions, an attacker may be able to cause a connector to resolve and disclose a secret outside its intended scope:

• The process uses connectors and secrets.
• Untrusted input reaches a process variable — for example, through a user task, an inbound connector such as a webhook or email, or an API call.
• That process variable is passed, unsanitized, into a connector field (for example, an email body or an HTTP request field).
• The attacker can guess or know the name of a secret that exists in that context. This does not require knowing the secret's value, only its name.
• The connector's destination is one the attacker controls or can observe, or the attacker can also influence the destination itself (for example, a recipient address or URL supplied through another process variable).

Severity: High (CVSS 7.5).

How to determine if the installation is affected

You are using:

• Camunda Connectors 8.1.x through 8.9.x, on Self-Managed or SaaS, with connectors and secrets configured as described above.

Solution

Camunda has released a secret filter for the connector runtime, defaulting to STRICT mode. In STRICT mode, a connector only resolves a secret that's present for that specific field in the deployed BPMN XML, which structurally closes this vulnerability for both outbound and inbound connectors. This is a breaking change: after upgrading, a connector field that relied on resolving an undeclared secret stops resolving it. See secret filter for configuration details, including how to change the mode.

Camunda has provided the following releases which contain the fix:

• Camunda Connectors 8.9.10, 8.8.19, 8.7.25, 8.6.28

On Camunda 8 SaaS, this fix is included automatically unless you've opted out of auto-updates, in which case you'll need to update your cluster manually. You can also change the mode per cluster in cluster settings.

Interim mitigation:

• Review your process deployments against the preconditions above.
• If a process may be affected, search its process instance variables for a secret-reference literal — for example, using the Search process instances API with a $like filter on 8.8 and later. This check is not conclusive: it only reflects the variable's current value, within your retention period.
• Adjust the affected process so the preconditions above no longer hold, or sanitize the process variable to remove secret-reference syntax before it reaches a connector field.
  • Sanitize the respective process variable for example by replacing secrets keyword: = replace(emailBody, "secrets?\.", "secretx_", "i")
• Rotate any secret that may have been exposed, following your organization's secret-management procedures.

Notice 60

Publication date

September 2, 2026

Products affected

• Camunda Zeebe
• Camunda Tasklist
• Camunda Operate
• Camunda Optimize

Impact

The application was vulnerable to CVE-2026-71290, where the embedded httpclient5 library's asynchronous transport, used to connect to the Elasticsearch/OpenSearch secondary storage, skipped hostname verification during the TLS handshake. An attacker positioned to intercept network traffic between the affected component and its Elasticsearch/OpenSearch backend (for example, via DNS spoofing, BGP hijacking, or a compromised host on a shared network segment) could impersonate the backend, intercept the Basic authentication credentials sent to it, read or tamper with process data (including variables and process instance data) in transit, and inject forged responses back to the application. Exploitation requires this man-in-the-middle network position; it does not require bypassing authentication on the application's own API. Camunda is not aware of any known exploitation of this vulnerability.

How to determine if the installation is affected

You are using:

• Camunda Zeebe ≤ 8.7.37
• Camunda Tasklist ≤ 8.7.37
• Camunda Operate ≤ 8.7.37
• Camunda Optimize ≤ 8.7.26

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Zeebe 8.7.38
• Camunda Tasklist 8.7.38
• Camunda Operate 8.7.38
• Camunda Optimize 8.7.27

Notice 59

Publication date

July 29, 2026

Products affected

• Camunda Web Modeler

Impact

The version of undertow-core used by Camunda Web Modeler was affected by the following vulnerabilities which could potentially allow an attacker to perform request smuggling by exploiting flaws in the HTTP request header parsing:

• CVE-2026-28367
• CVE-2026-28368
• CVE-2026-28369

How to determine if the installation is affected

You are using:

• Web Modeler Self-Managed ≤ 8.8.14, or ≤ 8.7.21

Solution

Camunda has provided the following releases that contain the fix:

• Web Modeler Self-Managed 8.8.15, 8.7.22

Notice 58

Publication date

July 14, 2026

Products affected

• Camunda Web Modeler

Impact

The application was vulnerable to CVE-2026-54399, where a flaw in the HTTP/1.1 message parser in Apache HttpComponents Core allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with an excessive number of headers or excessively long headers.

The vulnerable library is only used in outgoing HTTP requests from Web Modeler to the Camunda 8 Orchestration Cluster API. To exploit the vulnerability, an attacker would need to be able to control or intercept the API responses through a prior attack. Web Modeler's inbound HTTP requests are handled by a different library, so the vulnerable code path is not reachable from external, untrusted client traffic.

How to determine if the installation is affected

• You are using Web Modeler Self-Managed ≤ 8.9.5, ≤ 8.8.16, or ≤ 8.7.23.

Solution

Camunda has provided the following releases which contain the fix:

• Web Modeler Self-Managed 8.9.6, 8.8.17, 8.7.24

The fix was deployed to Web Modeler SaaS on July 8, 2026, 08:12 CET.

Notice 57

Publication date

July 14, 2026

Products affected

• Camunda Web Modeler

Impact

The application was vulnerable to CVE-2026-54291, where database connections configured with channelBinding=require can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee.

How to determine if the installation is affected

• You are using Web Modeler Self-Managed ≤ 8.9.5, ≤ 8.8.16, or ≤ 8.7.23.
• And: You are using PostgreSQL with SCRAM authentication over SSL/TLS and channelBinding=require.

Solution

Camunda has provided the following releases which contain the fix:

• Web Modeler Self-Managed 8.9.6, 8.8.17, 8.7.24

The fix was deployed to Web Modeler SaaS on July 8, 2026, 08:12 CET.

Notice 56

Publication date

July 14, 2026

Products affected

• Camunda Optimize

Impact

The application was vulnerable to CVE-2026-13006, an arbitrary code execution vulnerability in the logback-core library used by Camunda Optimize. An attacker who already has write access to the Logback configuration file, or the ability to inject an environment variable evaluated at startup, could execute arbitrary code in the Optimize process. Exploitation also requires the Janino library on the classpath and a Logback configuration that uses conditional (<if>) processing, both of which are present in Camunda Optimize. This vulnerability is not remotely exploitable; it requires an attacker to already hold privileged local access to the deployment.

How to determine if the installation is affected

You are using:

• Camunda Optimize ≤ 8.7.24

Solution

Camunda has provided the following release which contains the fix:

• Camunda Optimize 8.7.25

Notice 55

Publication date

July 1, 2026

Products affected

• Camunda Identity
• Camunda Zeebe
• Camunda Tasklist
• Camunda Operate
• Camunda Optimize

Impact

The application was vulnerable to CVE-2026-40983, where an unauthenticated attacker can send a specially crafted gRPC request to trigger uncontrolled resource consumption inside Micrometer's gRPC instrumentation layer, rendering the affected component unresponsive until restarted.

How to determine if the installation is affected

You are using:

• Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
• Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Identity 8.9.5, 8.8.14, 8.7.21
• Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
• Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
• Camunda Operate 8.9.10, 8.8.29, 8.7.34
• Camunda Optimize 8.9.10, 8.8.29, 8.7.23

Notice 54

Publication date

July 1, 2026

Products affected

• Camunda Identity
• Camunda Zeebe
• Camunda Tasklist
• Camunda Operate
• Camunda Optimize
• Camunda Web Modeler

Impact

The application was vulnerable to CVE-2026-40984, where an unauthenticated attacker can send a specially crafted HTTP request to trigger uncontrolled resource consumption inside Micrometer's HTTP instrumentation layer, rendering the affected component unresponsive until restarted.

How to determine if the installation is affected

You are using:

• Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
• Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22
• Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Identity 8.9.5, 8.8.14, 8.7.21
• Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
• Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
• Camunda Operate 8.9.10, 8.8.29, 8.7.34
• Camunda Optimize 8.9.10, 8.8.29, 8.7.23
• Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23

Notice 53

Publication date

July 1, 2026

Products affected

• Camunda Identity
• Camunda Zeebe
• Camunda Tasklist
• Camunda Operate
• Camunda Optimize
• Camunda Web Modeler

Impact

The application was vulnerable to CVE-2026-11400, where a successful exploit grants the attacker elevated database privileges on Amazon Aurora PostgreSQL, potentially enabling unauthorized read/write access to all application data stored in the database.

How to determine if the installation is affected

You are using:

• Camunda Identity ≤ 8.9.4
• Camunda Zeebe ≤ 8.9.10
• Camunda Tasklist ≤ 8.9.10
• Camunda Operate ≤ 8.9.10
• Camunda Optimize ≤ 8.9.10
• Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

And your deployment is running on Amazon Aurora PostgreSQL with the AWS Advanced JDBC Wrapper configured to use the GlobalDatabasePlugin (for example, by setting wrapperPlugins=globaldb or equivalent in the JDBC connection URL). This is not the default Camunda configuration.

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Identity 8.9.5
• Camunda Zeebe 8.9.11
• Camunda Tasklist 8.9.11
• Camunda Operate 8.9.11
• Camunda Optimize 8.9.11
• Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23

Notice 52

Publication date

July 1, 2026

Products affected

• Camunda Zeebe
• Camunda Tasklist
• Camunda Operate
• Camunda Web Modeler

Impact

The application was vulnerable to CVE-2026-47691, where an attacker controlling a subdomain's name server can provide crafted NS records to poison the DNS cache for parent domains, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.

How to determine if the installation is affected

You are using:

• Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
• Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
• Camunda Operate 8.9.10, 8.8.29, 8.7.34
• Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23

Notice 51

Publication date

July 1, 2026

Products affected

• Camunda Zeebe
• Camunda Tasklist
• Camunda Operate
• Camunda Web Modeler

Impact

The application was vulnerable to CVE-2026-45674, where a remote attacker can achieve information disclosure or data manipulation by crafting malicious DNS responses.

How to determine if the installation is affected

You are using:

• Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
• Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
• Camunda Operate 8.9.10, 8.8.29, 8.7.34
• Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23

Notice 50

Publication date

July 1, 2026

Products affected

• Camunda Identity
• Camunda Zeebe
• Camunda Tasklist
• Camunda Operate
• Camunda Optimize

Impact

The application was vulnerable to CVE-2026-41842, where an attacker could send requests that are slow to resolve, keeping HTTP connections busy and potentially causing a Denial of Service. This is a Denial of Service vulnerability in Spring MVC and WebFlux static resource resolution. The default Camunda configuration is not exploitable; the vulnerability requires both versioned resource resolution to be enabled (for example, by setting spring.web.resources.chain.strategy.content.enabled=true) and static resources to be served from the filesystem (for example, by setting spring.web.resources.static-locations=file:/...), neither of which is present in the default configuration.

How to determine if the installation is affected

You are using:

• Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
• Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22

And your deployment has versioned resource resolution enabled and static resources served from the filesystem.

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Identity 8.9.5, 8.8.14, 8.7.21
• Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
• Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
• Camunda Operate 8.9.10, 8.8.29, 8.7.34
• Camunda Optimize 8.9.10, 8.8.29, 8.7.23

Notice 49

Publication date

July 1, 2026

Products affected

• Camunda Identity
• Camunda Zeebe
• Camunda Tasklist
• Camunda Operate
• Camunda Optimize
• Camunda Web Modeler

Impact

The application was vulnerable to CVE-2026-41841, where an attacker could gain access to a protected static resource if a resource with the same name had previously been resolved from a publicly accessible handler and cached server-side. This is an information disclosure vulnerability in Spring MVC and WebFlux static resource handling. The default Camunda configuration is not exploitable; the vulnerability requires server-side resource-chain caching to be enabled (for example, by setting spring.web.resources.chain.cache=true) and at least one resource handler that serves authentication-protected assets, neither of which is present in the default configuration.

How to determine if the installation is affected

You are using:

• Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
• Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
• Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22
• Camunda Web Modeler ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

And your deployment has server-side resource-chain caching enabled with at least one access-controlled resource handler configured.

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Identity 8.9.5, 8.8.14, 8.7.21
• Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
• Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
• Camunda Operate 8.9.10, 8.8.29, 8.7.34
• Camunda Optimize 8.9.10, 8.8.29, 8.7.23
• Camunda Web Modeler 8.9.5, 8.8.16, 8.7.23

Notice 48

Publication date

May 13, 2026

Products affected

• Camunda Identity
• Camunda Zeebe
• Camunda Tasklist
• Camunda Operate
• Camunda Web Modeler

Impact

The application was vulnerable to CVE-2026-42198, where an attacker with the privileges to impersonate or perform a man-in-the-middle (MITM) attack on the PostgreSQL server can force the JDBC driver to perform SCRAM authentication with a very large iteration count. This can lead to high CPU usage during the SCRAM PBKDF2 computation before authentication can fail. Web Modeler and Identity are affected by this CVE when run with their default configuration. Zeebe, Operate, and Tasklist are only affected in a self-managed setup when running the application with RDBMS as secondary storage with a PostgreSQL server configured as the endpoint.

How to determine if the installation is affected

You are using:

• Camunda Identity ≤ 8.9.2, ≤ 8.8.11, or ≤ 8.7.18
• Camunda Zeebe ≤ 8.9.2, ≤ 8.8.23, or ≤ 8.7.28
• Camunda Tasklist ≤ 8.9.2, ≤ 8.8.23, or ≤ 8.7.28
• Camunda Operate ≤ 8.9.2, ≤ 8.8.23, or ≤ 8.7.28
• Camunda Web Modeler ≤ 8.9.2, ≤ 8.8.13, or ≤ 8.7.20

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Identity 8.9.3, 8.8.12, 8.7.19
• Camunda Zeebe 8.9.3, 8.8.24, 8.7.29
• Camunda Tasklist 8.9.3, 8.8.24, 8.7.29
• Camunda Operate 8.9.3, 8.8.24, 8.7.29
• Camunda Web Modeler 8.9.3, 8.8.14, 8.7.21

Notice 47

Publication date

May 7, 2026

Products affected

• Camunda Identity
• Camunda Zeebe
• Camunda Tasklist
• Camunda Operate
• Camunda Optimize
• Camunda Web Modeler

Impact

The application was vulnerable to CVE-2026-40973, where a local attacker could take control of the embedded Spring Boot ApplicationTemp directory. If server.servlet.session.persistent is set to true, this could allow session hijacking or arbitrary code execution. Default Camunda 8 deployments are not affected.

How to determine if the installation is affected

You are using:

• Camunda Identity ≤ 8.9.1, ≤ 8.8.11, or ≤ 8.7.18
• Camunda Zeebe ≤ 8.9.1, ≤ 8.8.23, or ≤ 8.7.28
• Camunda Tasklist ≤ 8.9.1, ≤ 8.8.23, or ≤ 8.7.28
• Camunda Operate ≤ 8.9.1, ≤ 8.8.23, or ≤ 8.7.28
• Camunda Optimize ≤ 8.9.1, ≤ 8.8.8, or ≤ 8.7.20
• Camunda Web Modeler ≤ 8.9.1, ≤ 8.8.13, or ≤ 8.7.20

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Identity 8.9.2, 8.8.12, 8.7.19
• Camunda Zeebe 8.9.2, 8.8.24, 8.7.29
• Camunda Tasklist 8.9.2, 8.8.24, 8.7.29
• Camunda Operate 8.9.2, 8.8.24, 8.7.29
• Camunda Optimize 8.9.2, 8.8.24, 8.7.21
• Camunda Web Modeler 8.9.2, 8.8.14, 8.7.21

Notice 46

Publication date

May 7, 2026

Products affected

• Camunda Web Modeler

Impact

The version of axios used by Camunda Web Modeler was affected by CVE-2026-42264, a prototype pollution vulnerability in the HTTP adapter that could allow credential injection and request hijacking when Object.prototype is polluted by another dependency in the same process.

How to determine if the installation is affected

You are using:

• Web Modeler Self-Managed ≤ 8.8.13, or ≤ 8.7.20

Solution

Camunda has provided the following releases that contain the fix:

• Web Modeler Self-Managed 8.8.14, 8.7.21

Notice 45

Publication date

April 24, 2026

Products affected

• Camunda Tasklist
• Camunda Zeebe
• Camunda Operate

Impact

The application was vulnerable to CVE-2026-5588, where the PKIX CompositeVerifier in the embedded Bouncy Castle cryptography library could accept an empty signature sequence as valid, weakening certificate signature verification and potentially allowing acceptance of improperly signed certificates.

How to determine if the installation is affected

You are using:

• Camunda Tasklist 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
• Camunda Zeebe 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
• Camunda Operate 8.9.0, ≤ 8.8.22, or ≤ 8.7.27

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Tasklist 8.9.1, 8.8.23, 8.7.28
• Camunda Zeebe 8.9.1, 8.8.23, 8.7.28
• Camunda Operate 8.9.1, 8.8.23, 8.7.28

Notice 44

Publication date

April 24, 2026

Products affected

• Camunda Tasklist
• Camunda Zeebe
• Camunda Operate

Impact

The application was vulnerable to CVE-2025-14813, where the GOSTCTR implementation in the embedded Bouncy Castle cryptography library used an incorrect one-byte counter and could not securely encrypt or decrypt more than 255 blocks, potentially compromising the confidentiality and integrity of data encrypted with this algorithm.

How to determine if the installation is affected

You are using:

• Camunda Tasklist 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
• Camunda Zeebe 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
• Camunda Operate 8.9.0, ≤ 8.8.22, or ≤ 8.7.27

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Tasklist 8.9.1, 8.8.23, 8.7.28
• Camunda Zeebe 8.9.1, 8.8.23, 8.7.28
• Camunda Operate 8.9.1, 8.8.23, 8.7.28

Notice 43

Publication date

Apr 7, 2026

Products affected

• Management Identity
• Camunda Tasklist
• Camunda Zeebe
• Camunda Operate
• Camunda Optimize
• Camunda Web Modeler

Impact

When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP headers will not be written. This is related to CVE-2026-22732.

How to determine if the installation is affected

You are using:

• Management Identity 8.7.4 - 8.7.10, 8.7.12 - 8.7.16, 8.8.0 - 8.8.2, or 8.8.5 - 8.8.9
• Zeebe 8.7.21 - 8.7.25
• Tasklist 8.7.21 - 8.7.25
• Operate 8.7.22 - 8.7.25
• Optimize 8.7.14 - 8.7.18 or 8.8.2 - 8.8.7
• Web Modeler Self-Managed ≤ 8.6.26, ≤ 8.7.18, or ≤ 8.8.11

Solution

Camunda has provided the following releases which contain the fix:

• Management Identity 8.7.17, 8.8.10
• Zeebe 8.7.26
• Tasklist 8.7.26
• Operate 8.7.26
• Optimize 8.7.19, 8.8.8
• Web Modeler Self-Managed 8.6.27, 8.7.19, 8.8.12

The fix was deployed to Web Modeler SaaS on March 23, 2026, 17:26 CET.

Notice 42

Publication date

Mar 09, 2026

Products affected

• Management Identity

Impact

The application was vulnerable to CVE-2026-24734, which allowed an attacker to bypass revocation checks of client SSL certificates if a certain server configuration was used.

How to determine if the installation is affected

You are using:

• Management Identity ≤ 8.8.7, ≤ 8.7.14, or ≤ 8.6.27

Solution

Camunda has provided the following releases which contain the fix:

• Management Identity 8.8.8, 8.7.15, 8.6.28

Notice 41

Publication date

Mar 9, 2026

Products affected

• Camunda Web Modeler

Impact

The version of fast-xml-parser used by Camunda Web Modeler was affected by CVE-2026-26278, a vulnerability which could be exploited as a vector for denial of service attacks by forcing the parser to do an unlimited amount of entity expansions.

How to determine if the installation is affected

You are using:

• Web Modeler Self-Managed ≤ 8.8.8, ≤ 8.7.16, or ≤ 8.6.25

Solution

Camunda has provided the following releases that contain the fix:

• Web Modeler Self-Managed 8.8.9, 8.7.17, 8.6.26

This issue does not affect Web Modeler SaaS.

Notice 40

Publication date

Feb 23, 2026

Products affected

C7 to C8 Migration Tooling

Impact

The version of Tomcat used by the Diagram Converter Webapp was affected by:

• CVE-2025-66614
• CVE-2026-24734

How to determine if the installation is affected

You are using:

• C7 to C8 Migration Tooling 0.2.0 AND
• the Diagram Converter Webapp

Solution

Camunda has released the C7 to C8 Migration Tooling 0.2.1, which includes the fix.

Notice 39

Publication date

Feb 10, 2026

Products affected

• Camunda Web Modeler

Impact

The version of fast-xml-parser used by Camunda Web Modeler was affected by CVE-2026-25128, a RangeError vulnerability that could crash any application that processes untrusted XML input.

How to determine if the installation is affected

You are using:

• Web Modeler Self-Managed ≤ 8.8.6, ≤ 8.7.15, or ≤ 8.6.24

Solution

Camunda has provided the following releases that contain the fix:

• Web Modeler Self-Managed 8.8.7, 8.7.16, 8.6.25

The fix was deployed to Web Modeler SaaS on February 2, 2026, 15:15 CET.

Notice 38

Publication date

Jan 8, 2026

Products affected

• Camunda Web Modeler

Impact

The version of qs used by Camunda Web Modeler was affected by CVE-2025-15284, an improper input validation vulnerability that allows HTTP DoS.

How to determine if the installation is affected

You are using:

• Web Modeler Self-Managed ≤ 8.8.4, ≤ 8.7.14, or ≤ 8.6.23

Solution

Camunda has provided the following releases that contain the fix:

• Web Modeler Self-Managed 8.8.5, 8.7.15, 8.6.24

The fix was deployed to Web Modeler SaaS on January 7, 2026, 13:45 CET.

Notice 37

Publication date

December 12, 2025

Products affected

• Camunda Tasklist
• Camunda Zeebe
• Camunda Operate

Impact

The application is vulnerable to CVE-2025-12183, which allows remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

How to determine if the installation is affected

You are using:

• Tasklist/Zeebe/Operate ≤ 8.8.6, ≤ 8.7.20, or ≤ 8.6.32

Solution

Camunda has provided the following releases which contain the fix:

• Tasklist/Zeebe/Operate 8.8.7, 8.7.21, 8.6.33

Notice 36

Publication date

December 03, 2025

Products affected

• Management Identity

Impact

The application is vulnerable to CVE-2025-53066, which allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.

How to determine if the installation is affected

You are using:

• Management Identity ≤ 8.8.2, ≤ 8.7.10, or ≤ 8.6.22

Solution

Camunda has provided the following releases which contain the fix:

• Management Identity 8.8.3, 8.7.11, 8.6.23

Notice 35

Publication date

November 26, 2025

Products affected

• Camunda Web Modeler Self-Managed
• Camunda Management Identity

Impact

The embedded JDBC driver for Amazon Aurora PostgreSQL (software.amazon.jdbc:aws-advanced-jdbc-wrapper) was affected by CVE-2025-12967, which may allow for privilege escalation to the rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

How to determine if the installation is affected

You are using:

• Web Modeler Self-Managed ≤ 8.8.2, ≤ 8.7.12, or ≤ 8.6.21 with Amazon Aurora PostgreSQL
• Management Identity ≤ 8.8.1, ≤ 8.7.9, or ≤ 8.6.21 with Amazon Aurora PostgreSQL

Solution

Camunda has provided the following releases which contain the fix:

• Web Modeler Self-Managed 8.8.3, 8.7.13, 8.6.22
• Management Identity 8.8.2, 8.7.10, 8.6.22

Notice 34

Publication date

November 11, 2025

Products affected

• Camunda Web Modeler Self-Managed

Impact

The version of the MSSQL JDBC driver com.microsoft.sqlserver:mssql-jdbc used by Web Modeler was affected by CVE-2025-59250, which allows improper input validation that could enable an attacker to perform spoofing over a network.

How to determine if the installation is affected

You are using Web Modeler Self-Managed version <= 8.8.1 and Microsoft SQL Server as database vendor.

Solution

Camunda has provided the following release which contains the fix:

• Web Modeler Self-Managed 8.8.2

Notice 33

Publication date

October 22, 2025

Products affected

• Camunda Orchestration Cluster

Impact

A bug in signal broadcast command processing allowed unauthorized users to trigger signal start events or signal intermediate catch events in certain process definitions without the required create or update permissions.

This did not allow users to access process definitions of other tenants, or leak any information about these process instances back to the unauthorized users.

How to determine if the installation is affected

You are using:

• Orchestration Cluster 8.8.0

Solution

Camunda has provided the following release which contains the fix:

• Orchestration Cluster 8.8.1

Notice 32

Publication date

October 21, 2025

Products affected

• Camunda Management Identity

Impact

The embedded Apache Tomcat was affected by CVE-2025-48989 which made Tomcat vulnerable to the MadeYouReset attack.

How to determine if the installation is affected

You are using:

• Management Identity 8.7.0 - 8.7.4 or 8.7.6 - 8.7.7

Solution

Camunda has provided the following release which contains the fix:

• Management Identity 8.7.8

Notice 31

Publication date

October 16, 2025

Products affected

• Camunda Web Modeler

Impact

The embedded Undertow web server was affected by CVE-2025-9784, a flaw where malformed client requests can trigger server-side stream resets without incrementing abuse counters.

This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts and could be exploited to cause a denial of service (DoS).

How to determine if the installation is affected

You are using:

• Web Modeler Self-Managed 8.8.0, ≤ 8.7.10, or ≤ 8.6.19

Solution

Camunda has provided the following releases which contain the fix:

• Web Modeler Self-Managed 8.8.1, 8.7.11, 8.6.20

The fix was deployed to Web Modeler SaaS on October 14, 2025, 14:26 CET.

Notice 30

Publication date

October 7th, 2025

Products affected

• Camunda Tasklist
• Camunda Zeebe
• Camunda Operate
• Camunda Optimize
• Camunda Management Identity

Impact

The embedded Netty was affected by CVE-2025-58056, an HTTP request smuggling vulnerability in Netty. Incorrect parsing of chunked transfer encoding could allow attackers to craft malicious requests that are interpreted inconsistently by proxies and Netty.

How to determine if the installation is affected

You are using:

• Tasklist 8.7.0 - 8.7.12 or 8.5.0 - 8.5.22
• Zeebe 8.7.0 - 8.7.12 or 8.5.0 - 8.5.24
• Operate 8.7.0 - 8.7.12 or 8.5.0 - 8.5.20
• Optimize 8.7.0 - 8.7.9 or 8.6.0 - 8.6.16
• Management Identity 8.7.0 - 8.7.6 or 8.6.0 - 8.6.19 or 8.5.0 - 8.5.21

Solution

Camunda has provided the following releases which contain the fix:

• Tasklist 8.7.13, 8.5.23
• Zeebe 8.7.13, 8.5.25
• Operate 8.7.13, 8.5.21
• Optimize 8.7.10, 8.6.17
• Management Identity 8.7.7, 8.6.20, 8.5.22

Notice 29

Publication date

October 3, 2025

Products affected

• Camunda Zeebe

Impact

Zeebe may be affected by CVE-2024-41996, which allows remote attackers to trigger expensive server-side DHE modular-exponentiation calculations, potentially causing asymmetric resource consumption and DoS attacks.

How to determine if the installation is affected

You are potentially affected if you have configured Zeebe to accept DHE or ECDHE cipher suites through the server.ssl.ciphers property or SERVER_SSL_CIPHERS environment variable.

Default Zeebe installations are not affected.

Solution

Configure the server.ssl.ciphers property or SERVER_SSL_CIPHERS environment variable to exclude DHE and ECDHE cipher suites. For example:

server.ssl.ciphers=TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA

There is no known mitigation other than disabling the use of DHE and ECDHE cipher suites.

Notice 28

Publication date

September 9, 2025

Products affected

• Camunda Optimize

Impact

Optimize was affected by CVE-2025-5115, which allows a remote attacker to repeatedly send malformed HTTP/2 frames that exhaust a Jetty server’s CPU and memory, causing a denial-of-service.

How to determine if the installation is affected

You are using:

• Optimize 8.7.0 - 8.7.8 or 8.6.0 - 8.6.15

Solution

Camunda has provided the following releases which contain the fix:

• Optimize 8.7.9, 8.6.16

Notice 27

Publication date

August 27, 2025

Products affected

• Camunda Optimize

Impact

Optimize's email functionality was affected by CVE-2025-7962, which allowed for SMTP injection by providing forged email recipient addresses that could lead to malicious content being sent to arbitrary recipients.

How to determine if the installation is affected

You are using:

• Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

• Optimize 8.7.8, 8.6.15

Notice 26

Publication date

August 27, 2025

Products affected

• Camunda Optimize

Impact

Optimize was affected by CVE-2025-53864 which allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion.

How to determine if the installation is affected

You are using:

• Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

• Optimize 8.7.8, 8.6.15

Notice 25

Publication date

August 27, 2025

Products affected

• Camunda Tasklist
• Camunda Zeebe
• Camunda Operate
• Camunda Optimize

Impact

The embedded Apache Tomcat was affected by CVE-2025-48989 which made Tomcat vulnerable to the MadeYouReset attack.

How to determine if the installation is affected

You are using:

• Tasklist 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.20
• Zeebe 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24
• Operate 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.18
• Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

• Tasklist 8.7.11, 8.6.25, 8.5.21
• Zeebe 8.7.11, 8.6.25
• Operate 8.7.11, 8.6.25, 8.5.19
• Optimize 8.7.8, 8.6.15

Notice 24

Publication date

August 27, 2025

Products affected

• Camunda Tasklist
• Camunda Zeebe
• Camunda Operate
• Camunda Management Identity
• Camunda Optimize

Impact

The embedded Netty was affected by CVE-2025-55163 which allows malformed HTTP/2 control frames usage that results in resource exhaustion and distributed denial of service.

How to determine if the installation is affected

You are using:

• Tasklist 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.20
• Zeebe 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.22
• Operate 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.18
• Management Identity 8.7.0 - 8.7.5 or 8.6.0 - 8.6.18 or 8.5.0 - 8.5.19
• Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

• Tasklist 8.7.11, 8.6.25, 8.5.21
• Zeebe 8.7.11, 8.6.25, 8.5.23
• Operate 8.7.11, 8.6.25, 8.5.19
• Management Identity 8.7.6, 8.6.19, 8.5.20
• Optimize 8.7.8, 8.6.15

Notice 23

Publication date

July 31, 2025

Products affected

• Camunda Tasklist
• Camunda Zeebe
• Camunda Operate
• Camunda Management Identity
• Camunda Optimize

Impact

The embedded Spring Boot Tomcat was affected by CVE-2025-53506 which allowed for uncontrolled resource consumption that could be used to exhaust system resources in a potential DoS (denial of service) attack.

How to determine if the installation is affected

You are using:

• Tasklist 8.7.0 - 8.7.8 or 8.6.0 - 8.6.22 or 8.5.0 - 8.5.18
• Zeebe 8.7.0 - 8.7.8 or 8.6.0 - 8.6.22
• Operate 8.7.0 - 8.7.8 or 8.6.0 - 8.6.22 or 8.5.0 - 8.5.16
• Management Identity 8.7.0 - 8.7.4 or 8.6.0 - 8.6.17 or 8.5.0 - 8.5.18
• Optimize 8.7.0 - 8.7.6 or 8.6.0 - 8.6.12

Solution

Camunda has provided the following releases which contain the fix:

• Tasklist 8.7.9, 8.6.23, 8.5.19
• Zeebe 8.7.9, 8.6.23
• Operate 8.7.9, 8.6.23, 8.5.17
• Management Identity 8.7.5, 8.6.18, 8.5.19
• Optimize 8.7.7, 8.6.13

Notice 22

Publication date

July 31, 2025

Products affected

• Camunda Tasklist
• Camunda Zeebe
• Camunda Operate

Impact

Part of our RESTful API that supported multipart file uploads was affected by CVE-2025-52520, which could lead to potential DoS (denial of service) attacks.

How to determine if the installation is affected

You are using:

• Tasklist 8.6.0 - 8.6.22 or 8.7.0 - 8.7.8
• Zeebe 8.6.0 - 8.6.22 or 8.7.0 - 8.7.8
• Operate 8.6.0 - 8.6.22 or 8.7.0 - 8.7.8

Solution

Camunda has provided the following releases which contain the fix:

• Tasklist 8.6.22
• Tasklist 8.7.9
• Zeebe 8.6.23
• Zeebe 8.7.9
• Operate 8.6.23
• Operate 8.7.9

Notice 21

Publication date

June 18, 2025

Products affected

Camunda Web Modeler Self-Managed

Impact

The version of org.postgresql:postgresql used by Camunda Web Modeler Self-Managed was affected by CVE-2025-49146 potentially allowing a man-in-the-middle attacker to intercept connections when the PostgreSQL JDBC driver was configured with channel binding set to required.

How to determine if the installation is affected

You are using Camunda Web Modeler Self-Managed version 8.6.0 - 8.6.12, or 8.7.0 - 8.7.3.

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Web Modeler Self-Managed 8.6.12
• Camunda Web Modeler Self-Managed 8.7.3

Notice 20

Publication date

June 17, 2025

Products affected

Camunda Optimize

Impact

Camunda Optimize was affected by a vulnerability that allowed an attacker to gain improper access to Optimize data by using a modified JWT (JSON Web Token).

How to determine if the installation is affected

You are using Camunda Optimize ≤ 8.6.9 or ≤ 8.7.2.

Solution

Camunda has provided the following release which contains a fix:

• Camunda Optimize 8.6.10
• Camunda Optimize 8.7.3

Notice 19

Publication date

May 21, 2025

Products affected

Camunda Web Modeler

Impact

The version of nodejs used by Camunda Web Modeler was affected by CVE-2025-23166 potentially allowing an adversary to remotely crash the Node.js runtime.

How to determine if the installation is affected

You are using Camunda Web Modeler Self-Managed version ≤ 8.4.17, ≤ 8.5.18, ≤ 8.6.10, or ≤ 8.7.1.

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Web Modeler Self-Managed 8.4.18
• Camunda Web Modeler Self-Managed 8.5.19
• Camunda Web Modeler Self-Managed 8.6.11
• Camunda Web Modeler Self-Managed 8.7.2

The fix was deployed to Web Modeler SaaS on May 19, 2025, 15:10 CET.

Notice 18

Publication date

April 8, 2025

Products affected

Camunda Optimize

Impact

Camunda Optimize was affected by a vulnerability that allowed an attacker to modify a JWT (JSON Web Token) so that they would be given improper access to Optimize.

How to determine if the installation is affected

You are using Camunda Optimize ≤ 8.4.15, ≤ 8.5.12, ≤ 8.6.6, ≤ 8.7.0, ≤ 3.11.20, ≤ 3.12.15, ≤ 3.13.12, ≤ 3.14.3, ≤ 3.15.1.

Solution

Camunda has provided the following release which contains a fix:

• Camunda Optimize 8.4.16, 8.5.13, 8.6.7, 8.7.0, 3.12.16, 3.13.13, 3.14.4, 3.15.2

Notice 17

Publication date

April 8, 2025

Products affected

Camunda Zeebe

Impact

When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.

• As Zeebe makes extensive use of Protobuf, this could lead to denial-of-service (DoS) issues on the server side.
• This issue allows an attacker to send specific payloads that will always result in StackOverflowException. This could lead to Zeebe Gateway performance issues and affect system availability.
• Although the Zeebe Gateway will not crash, it will spend more time working on these requests. An attacker could use this opportunity to slow it down and make it unusable by sending a large number of requests within a short time frame.

No data is leaked, lost, or corrupted. This issue only affects application availability.

Learn more about this CVE at the GitHub Advisory Database.

How to determine if the installation is affected

You are using Camunda Zeebe 8.6.11.

Solution

Camunda has provided the following release which contains a fix:

• Camunda Zeebe 8.6.13

Notice 16

Publication date

March 14, 2025

Products affected

Camunda Zeebe

Impact

Some Camunda Zeebe versions were affected by a vulnerability that allowed a malicious attacker to craft network packets that could crash the Zeebe Gateway.

How to determine if the installation is affected

You are using Camunda Zeebe 8.6.0 - 8.6.11

Solution

Camunda has provided the following release which contains a fix:

• Camunda Zeebe 8.6.12

Notice 15

Publication date

March 11, 2025

Products affected

Camunda Optimize

Impact

Some Camunda Optimize versions were affected by a vulnerability that allowed a malicious attacker to craft Camunda URLs that could execute JavaScript code.

How to determine if the installation is affected

You are using Camunda Optimize ≤ 8.6.5.

Solution

Camunda has provided the following release which contains a fix:

• Camunda Optimize 8.6.6

Notice 14

Publication date

March 11, 2025

Products affected

Camunda Web Modeler

Impact

The version of koa used by Camunda Web Modeler was affected by the following vulnerability:

• https://nvd.nist.gov/vuln/detail/CVE-2025-25200

How to determine if the installation is affected

You are using Camunda Web Modeler Self-Managed version ≤ 8.3.16, ≤ 8.4.14, ≤ 8.5.15, or ≤ 8.6.7.

Solution

Camunda has provided the following releases which contain the fix:

• Camunda Web Modeler Self-Managed 8.3.17
• Camunda Web Modeler Self-Managed 8.4.15
• Camunda Web Modeler Self-Managed 8.5.16
• Camunda Web Modeler Self-Managed 8.6.8

The fix was deployed to Web Modeler SaaS on February 14, 2025, 08:50 CET.

Notice 13

Publication date

July 18, 2024

Products affected

Camunda Management Identity

Impact

The version of Apache Tomcat used by Camunda Management Identity was affected by the following vulnerability:

• https://nvd.nist.gov/vuln/detail/CVE-2024-34750

How to determine if the installation is affected

You are using Camunda Management Identity version 8.5.3 or previous.

Solution

Camunda has provided the following release which contains a fix:

• Camunda Management Identity 8.5.4

Notice 12

Publication date

October 3, 2023

Products affected

Camunda Desktop Modeler

Impact

The version of libwebp shipped with Camunda Desktop Modeler was affected by the following vulnerability:

• https://nvd.nist.gov/vuln/detail/CVE-2023-4863

How to determine if the installation is affected

You are using Camunda Desktop Modeler version 5.15.1 or previous.

Solution

Camunda has provided the following release which contains a fix:

• Camunda Desktop Modeler 5.15.2

Notice 11

Publication date

April 17, 2023

Products affected

Tasklist

Impact

The Tasklist REST API functionality of Tasklist 8.2.0 and 8.2.1 allows unauthenticated access to the following methods/URLs:

• GET /v1/tasks/{taskId}
• POST /v1/tasks/search
• POST /v1/tasks/{taskId}/variables/search
• POST /v1/forms/{formId}
• POST /v1/variables/{variableId}

Find more information about the methods in our Tasklist REST API documentation.

Therefore, if you use Tasklist 8.2.0 or 8.2.1, and if you have sensible data stored in process variables (accessed by user tasks), this data could have been accessed by users knowing the endpoint of the Tasklist instance without authentication.

How to determine if the installation is affected

You are using Tasklist version 8.2.0 or 8.2.1.

Solution

Camunda has provided the following releases which contain a fix

• Tasklist 8.2.2

Notice 10

Publication Date:

November 10, 2022

Products affected:

Tasklist

Impact:

The Tasklist Docker image contain an OpenSSL version 3.0.2 for which the following CVEs have been published:

• https://nvd.nist.gov/vuln/detail/CVE-2022-3602
• https://nvd.nist.gov/vuln/detail/CVE-2022-3786

At this point, Camunda is not aware of any specific attack vector in Tasklist allowing attackers to exploit the vulnerability but recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are Tasklist version (8.0.3 ≥ version ≤ 8.0.7) or ≤ 8.1.2

Solution

Camunda has provided the following releases which contain a fix

• Tasklist 8.1.3
• Tasklist 8.0.8

Notice 9

Publication Date:

April 11, 2022

Products affected:

Zeebe, Operate, Tasklist, IAM

Impact:

Zeebe, Operate, Tasklist and IAM are using the Spring framework for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2022-22965

At this point, Camunda is not aware of any specific attack vector in Zeebe, Operate, Tasklist or IAM allowing attackers to exploit the vulnerability but recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are using Zeebe, Operate or Tasklist version ≤ 1.2.11 or ≤ 1.3.6

Solution

Camunda has provided the following releases which contain a fix

• Zeebe, Operate and Tasklist 1.3.7
• Zeebe, Operate and Tasklist 1.2.12

Notice 8

Publication Date:

December 31, 2021

Products affected:

Zeebe, Operate, Tasklist

Impact:

Zeebe, Operate and Tasklist bundle log4j-core for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2021-44832. At this point, Camunda is not aware of any specific attack vector in Zeebe, Operate or Tasklist allowing attackers to exploit the vulnerability but recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are using Zeebe, Operate or Tasklist version ≤ 1.2.8 or ≤ 1.1.9

Solution

Camunda has provided the following releases which contain a fix

• Zeebe, Operate and Tasklist 1.2.9
• Zeebe, Operate and Tasklist 1.1.10

Notice 7

Publication Date:

December 31, 2021

Products affected:

IAM

Impact:

IAM bundles log4j libraries for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2021-44832. Specifically, IAM bundles log4j-api and log4j-to-slf4j. However, IAM does not bundle the log4j-core library which contains the vulnerability referred to by the CVE. As a result, Camunda does not consider IAM to be affected by the vulnerability. Still, Camunda recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are using IAM version ≤ 1.2.8

Solution

Camunda has provided the following releases which contain a fix

• IAM 1.2.9

Notice 6

Publication Date:

December 22, 2021

Products affected:

Zeebe, Operate, Tasklist

Impact:

Zeebe, Operate and Tasklist bundle log4j-core for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2021-45105. At this point, Camunda is not aware of any specific attack vector in Zeebe, Operate or Tasklist allowing attackers to exploit the vulnerability but recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are using Zeebe, Operate or Tasklist version ≤ 1.2.7 or ≤ 1.1.8

Solution

Camunda has provided the following releases which contain a fix

• Zeebe, Operate and Tasklist 1.2.8
• Zeebe, Operate and Tasklist 1.1.9

Notice 5

Publication Date:

December 22, 2021

Products affected:

IAM

Impact:

IAM bundles log4j libraries for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2021-45105. Specifically, IAM bundles log4j-api and log4j-to-slf4j. However, IAM does not bundle the log4j-core library which contains the vulnerability referred to by the CVE. As a result, Camunda does not consider IAM to be affected by the vulnerability. Still, Camunda recommends applying fixes as mentioned in the Solution section below.

IAM bundles logback libraries for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2021-42550. At this point, Camunda is not aware of any specific attack vector in IAM allowing attackers to exploit the vulnerability but recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are using IAM version ≤ 1.2.7

Solution

Camunda has provided the following releases which contain a fix

• IAM 1.2.8

Notice 4

Publication Date:

December 17, 2021

Products affected:

Zeebe, Operate, Tasklist

Impact:

Zeebe, Operate and Tasklist bundle log4j-core for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2021-45046. At this point, Camunda is not aware of any specific attack vector in Zeebe, Operate or Tasklist allowing attackers to exploit the vulnerability but recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are using Zeebe, Operate or Tasklist version ≤ 1.2.6 or ≤ 1.1.7

Solution

Camunda has provided the following releases which contain a fix

• Zeebe, Operate and Tasklist 1.2.7
• Zeebe, Operate and Tasklist 1.1.8

Notice 3

Publication Date:

December 17, 2021

Products affected:

IAM

Impact:

IAM bundles log4j libraries for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2021-45046. Specifically, IAM bundles log4j-api and log4j-to-slf4j. However, IAM does not bundle the log4j-core library which contains the vulnerability referred to by the CVE. As a result, Camunda does not consider IAM to be affected by the vulnerability. Still, Camunda recommends applying fixes as mentioned in the Solution section below.

IAM bundles logback libraries for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2021-42550. At this point, Camunda is not aware of any specific attack vector in IAM allowing attackers to exploit the vulnerability but recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are using IAM version ≤ 1.2.6

Solution

Camunda has provided the following releases which contain a fix

• IAM 1.2.7

Notice 2

Publication Date:

December 14, 2021

Products affected:

Zeebe, Operate, Tasklist

Impact:

Zeebe, Operate and Tasklist bundle log4j-core for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2021-44228. At this point, Camunda is not aware of any specific attack vector in Zeebe, Operate or Tasklist allowing attackers to exploit the vulnerability but recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are using Zeebe, Operate or Tasklist version ≤ 1.2.5 or ≤ 1.1.6

Solution

Camunda has provided the following releases which contain a fix

• Zeebe, Operate and Tasklist 1.2.6
• Zeebe, Operate and Tasklist 1.1.7

Apply the patches mentioned above or set the JVM option -Dlog4j2.formatMsgNoLookups=true

Notice 1

Publication Date:

December 14, 2021

Products affected:

IAM

Impact:

IAM bundles log4j libraries for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2021-44228. Specifically, IAM bundles log4j-api and log4j-to-slf4j. However, IAM does not bundle the log4j-core library which contains the vulnerability referred to by the CVE. As a result, Camunda does not consider IAM to be affected by the vulnerability.

Still, Camunda recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are using IAM version ≤ 1.2.5

Solution

Camunda has provided the following releases which contain a fix

• IAM 1.2.6