Camunda — Security Notices https://docs.camunda.io/docs/reference/notices/ Security notices for Camunda 8 en Tue, 14 Jul 2026 14:58:55 GMT 60 http://www.rssboard.org/rss-specification https://docs.camunda.io/img/black-C.png Camunda — Security Notices https://docs.camunda.io/docs/reference/notices/ Notice 58 https://docs.camunda.io/docs/reference/notices/#notice-58 camunda-security-notice-58 Tue, 14 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-54399, where a flaw in the HTTP/1.1 message parser in Apache HttpComponents Core allows a remote attacker to cause a denial of service through memory exhaust... Camunda Web Modeler The application was vulnerable to CVE-2026-54399, where a flaw in the HTTP/1.1 message parser in Apache HttpComponents Core allows a remote attacker to cause a denial of service through memory exhaustion by sending messages with an excessive number of headers or excessively long headers.

The vulnerable library is only used in outgoing HTTP requests from Web Modeler to the Camunda 8 Orchestration Cluster API. To exploit the vulnerability, an attacker would need to be able to control or intercept the API responses through a prior attack. Web Modeler's inbound HTTP requests are handled by a different library, so the vulnerable code path is not reachable from external, untrusted client traffic.

How to determine if the installation is affected

  • You are using Web Modeler Self-Managed ≤ 8.9.5, ≤ 8.8.16, or ≤ 8.7.23.

Solution

Camunda has provided the following releases which contain the fix:

  • Web Modeler Self-Managed 8.9.6, 8.8.17, 8.7.24

The fix was deployed to Web Modeler SaaS on July 8, 2026, 08:12 CET.

]]> Notice 57 https://docs.camunda.io/docs/reference/notices/#notice-57 camunda-security-notice-57 Tue, 14 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-54291, where database connections configured with channelBinding=require can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCR... Camunda Web Modeler The application was vulnerable to CVE-2026-54291, where database connections configured with channelBinding=require can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to guarantee.

How to determine if the installation is affected

  • You are using Web Modeler Self-Managed ≤ 8.9.5, ≤ 8.8.16, or ≤ 8.7.23.
  • And: You are using PostgreSQL with SCRAM authentication over SSL/TLS and channelBinding=require.

Solution

Camunda has provided the following releases which contain the fix:

  • Web Modeler Self-Managed 8.9.6, 8.8.17, 8.7.24

The fix was deployed to Web Modeler SaaS on July 8, 2026, 08:12 CET.

]]> Notice 56 https://docs.camunda.io/docs/reference/notices/#notice-56 camunda-security-notice-56 Tue, 14 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-13006, an arbitrary code execution vulnerability in the logback-core library used by Camunda Optimize. An attacker who already has write access to the Logbac... Camunda Optimize The application was vulnerable to CVE-2026-13006, an arbitrary code execution vulnerability in the logback-core library used by Camunda Optimize. An attacker who already has write access to the Logback configuration file, or the ability to inject an environment variable evaluated at startup, could execute arbitrary code in the Optimize process. Exploitation also requires the Janino library on the classpath and a Logback configuration that uses conditional (<if>) processing, both of which are present in Camunda Optimize. This vulnerability is not remotely exploitable; it requires an attacker to already hold privileged local access to the deployment.

How to determine if the installation is affected

You are using:

  • Camunda Optimize ≤ 8.7.24

Solution

Camunda has provided the following release which contains the fix:

  • Camunda Optimize 8.7.25
]]> Notice 55 https://docs.camunda.io/docs/reference/notices/#notice-55 camunda-security-notice-55 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-40983, where an unauthenticated attacker can send a specially crafted gRPC request to trigger uncontrolled resource consumption inside Micrometer's gRPC inst... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize The application was vulnerable to CVE-2026-40983, where an unauthenticated attacker can send a specially crafted gRPC request to trigger uncontrolled resource consumption inside Micrometer's gRPC instrumentation layer, rendering the affected component unresponsive until restarted.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.5, 8.8.14, 8.7.21
  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Camunda Optimize 8.9.10, 8.8.29, 8.7.23
]]> Notice 54 https://docs.camunda.io/docs/reference/notices/#notice-54 camunda-security-notice-54 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-40984, where an unauthenticated attacker can send a specially crafted HTTP request to trigger uncontrolled resource consumption inside Micrometer's HTTP inst... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize Camunda Web Modeler The application was vulnerable to CVE-2026-40984, where an unauthenticated attacker can send a specially crafted HTTP request to trigger uncontrolled resource consumption inside Micrometer's HTTP instrumentation layer, rendering the affected component unresponsive until restarted.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22
  • Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.5, 8.8.14, 8.7.21
  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Camunda Optimize 8.9.10, 8.8.29, 8.7.23
  • Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23
]]> Notice 53 https://docs.camunda.io/docs/reference/notices/#notice-53 camunda-security-notice-53 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-11400, where a successful exploit grants the attacker elevated database privileges on Amazon Aurora PostgreSQL, potentially enabling unauthorized read/write ... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize Camunda Web Modeler The application was vulnerable to CVE-2026-11400, where a successful exploit grants the attacker elevated database privileges on Amazon Aurora PostgreSQL, potentially enabling unauthorized read/write access to all application data stored in the database.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.4
  • Camunda Zeebe ≤ 8.9.10
  • Camunda Tasklist ≤ 8.9.10
  • Camunda Operate ≤ 8.9.10
  • Camunda Optimize ≤ 8.9.10
  • Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

And your deployment is running on Amazon Aurora PostgreSQL with the AWS Advanced JDBC Wrapper configured to use the GlobalDatabasePlugin (for example, by setting wrapperPlugins=globaldb or equivalent in the JDBC connection URL). This is not the default Camunda configuration.

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.5
  • Camunda Zeebe 8.9.11
  • Camunda Tasklist 8.9.11
  • Camunda Operate 8.9.11
  • Camunda Optimize 8.9.11
  • Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23
]]> Notice 52 https://docs.camunda.io/docs/reference/notices/#notice-52 camunda-security-notice-52 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-47691, where an attacker controlling a subdomain's name server can provide crafted NS records to poison the DNS cache for parent domains, potentially redirec... Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Web Modeler The application was vulnerable to CVE-2026-47691, where an attacker controlling a subdomain's name server can provide crafted NS records to poison the DNS cache for parent domains, potentially redirecting users to malicious servers and leading to information disclosure or integrity compromise.

How to determine if the installation is affected

You are using:

  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23
]]> Notice 51 https://docs.camunda.io/docs/reference/notices/#notice-51 camunda-security-notice-51 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-45674, where a remote attacker can achieve information disclosure or data manipulation by crafting malicious DNS responses. Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Web Modeler The application was vulnerable to CVE-2026-45674, where a remote attacker can achieve information disclosure or data manipulation by crafting malicious DNS responses.

How to determine if the installation is affected

You are using:

  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Web Modeler Self-Managed ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Web Modeler Self-Managed 8.9.5, 8.8.16, 8.7.23
]]> Notice 50 https://docs.camunda.io/docs/reference/notices/#notice-50 camunda-security-notice-50 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-41842, where an attacker could send requests that are slow to resolve, keeping HTTP connections busy and potentially causing a Denial of Service. This is a D... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize The application was vulnerable to CVE-2026-41842, where an attacker could send requests that are slow to resolve, keeping HTTP connections busy and potentially causing a Denial of Service. This is a Denial of Service vulnerability in Spring MVC and WebFlux static resource resolution. The default Camunda configuration is not exploitable; the vulnerability requires both versioned resource resolution to be enabled (for example, by setting spring.web.resources.chain.strategy.content.enabled=true) and static resources to be served from the filesystem (for example, by setting spring.web.resources.static-locations=file:/...), neither of which is present in the default configuration.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22

And your deployment has versioned resource resolution enabled and static resources served from the filesystem.

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.5, 8.8.14, 8.7.21
  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Camunda Optimize 8.9.10, 8.8.29, 8.7.23
]]> Notice 49 https://docs.camunda.io/docs/reference/notices/#notice-49 camunda-security-notice-49 Wed, 01 Jul 2026 00:00:00 GMT The application was vulnerable to CVE-2026-41841, where an attacker could gain access to a protected static resource if a resource with the same name had previously been resolved from a publicly acces... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize Camunda Web Modeler The application was vulnerable to CVE-2026-41841, where an attacker could gain access to a protected static resource if a resource with the same name had previously been resolved from a publicly accessible handler and cached server-side. This is an information disclosure vulnerability in Spring MVC and WebFlux static resource handling. The default Camunda configuration is not exploitable; the vulnerability requires server-side resource-chain caching to be enabled (for example, by setting spring.web.resources.chain.cache=true) and at least one resource handler that serves authentication-protected assets, neither of which is present in the default configuration.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.4, ≤ 8.8.13, or ≤ 8.7.20
  • Camunda Zeebe ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Tasklist ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Operate ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.33
  • Camunda Optimize ≤ 8.9.9, ≤ 8.8.28, or ≤ 8.7.22
  • Camunda Web Modeler ≤ 8.9.4, ≤ 8.8.15, or ≤ 8.7.22

And your deployment has server-side resource-chain caching enabled with at least one access-controlled resource handler configured.

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.5, 8.8.14, 8.7.21
  • Camunda Zeebe 8.9.10, 8.8.29, 8.7.34
  • Camunda Tasklist 8.9.10, 8.8.29, 8.7.34
  • Camunda Operate 8.9.10, 8.8.29, 8.7.34
  • Camunda Optimize 8.9.10, 8.8.29, 8.7.23
  • Camunda Web Modeler 8.9.5, 8.8.16, 8.7.23
]]> Notice 48 https://docs.camunda.io/docs/reference/notices/#notice-48 camunda-security-notice-48 Wed, 13 May 2026 00:00:00 GMT The application was vulnerable to CVE-2026-42198, where an attacker with the privileges to impersonate or perform a man-in-the-middle (MITM) attack on the PostgreSQL server can force the JDBC driver t... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Web Modeler The application was vulnerable to CVE-2026-42198, where an attacker with the privileges to impersonate or perform a man-in-the-middle (MITM) attack on the PostgreSQL server can force the JDBC driver to perform SCRAM authentication with a very large iteration count. This can lead to high CPU usage inside the SCRAM PBKDF2 computation before authentication can fail. Web Modeler and Identity are affected by this CVE when run with their default configuration. Zeebe, Operate, and Tasklist are only affected in a self-managed setup when running the application with RDBMS as secondary storage with a PostgreSQL server configured as the endpoint.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.2, ≤ 8.8.11, or ≤ 8.7.18
  • Camunda Zeebe ≤ 8.9.2, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Tasklist ≤ 8.9.2, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Operate ≤ 8.9.2, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Web Modeler ≤ 8.9.2, ≤ 8.8.13, or ≤ 8.7.20

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.3, 8.8.12, 8.7.19
  • Camunda Zeebe 8.9.3, 8.8.24, 8.7.29
  • Camunda Tasklist 8.9.3, 8.8.24, 8.7.29
  • Camunda Operate 8.9.3, 8.8.24, 8.7.29
  • Camunda Web Modeler 8.9.3, 8.8.14, 8.7.21
]]> Notice 47 https://docs.camunda.io/docs/reference/notices/#notice-47 camunda-security-notice-47 Thu, 07 May 2026 00:00:00 GMT The application was vulnerable to CVE-2026-40973, where a local attacker could take control of the embedded Spring Boot ApplicationTemp directory. If server.servlet.session.persistent is set to true, ... Camunda Identity Camunda Zeebe Camunda Tasklist Camunda Operate Camunda Optimize Camunda Web Modeler The application was vulnerable to CVE-2026-40973, where a local attacker could take control of the embedded Spring Boot ApplicationTemp directory. If server.servlet.session.persistent is set to true, this could allow session hijacking or arbitrary code execution. Default Camunda 8 deployments are not affected.

How to determine if the installation is affected

You are using:

  • Camunda Identity ≤ 8.9.1, ≤ 8.8.11, or ≤ 8.7.18
  • Camunda Zeebe ≤ 8.9.1, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Tasklist ≤ 8.9.1, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Operate ≤ 8.9.1, ≤ 8.8.23, or ≤ 8.7.28
  • Camunda Optimize ≤ 8.9.1, ≤ 8.8.8, or ≤ 8.7.20
  • Camunda Web Modeler ≤ 8.9.1, ≤ 8.8.13, or ≤ 8.7.20

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Identity 8.9.2, 8.8.12, 8.7.19
  • Camunda Zeebe 8.9.2, 8.8.24, 8.7.29
  • Camunda Tasklist 8.9.2, 8.8.24, 8.7.29
  • Camunda Operate 8.9.2, 8.8.24, 8.7.29
  • Camunda Optimize 8.9.2, 8.8.24, 8.7.21
  • Camunda Web Modeler 8.9.2, 8.8.14, 8.7.21
]]> Notice 46 https://docs.camunda.io/docs/reference/notices/#notice-46 camunda-security-notice-46 Thu, 07 May 2026 00:00:00 GMT The version of axios used by Camunda Web Modeler was affected by CVE-2026-42264, a prototype pollution vulnerability in the HTTP adapter that could allow credential injection and request hijacking whe... Camunda Web Modeler The version of axios used by Camunda Web Modeler was affected by CVE-2026-42264, a prototype pollution vulnerability in the HTTP adapter that could allow credential injection and request hijacking when Object.prototype is polluted by another dependency in the same process.

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.8.13, or ≤ 8.7.20

Solution

Camunda has provided the following releases that contain the fix:

  • Web Modeler Self-Managed 8.8.14, 8.7.21
]]> Notice 45 https://docs.camunda.io/docs/reference/notices/#notice-45 camunda-security-notice-45 Fri, 24 Apr 2026 00:00:00 GMT The application was vulnerable to CVE-2026-5588, where the PKIX CompositeVerifier in the embedded Bouncy Castle cryptography library could accept an empty signature sequence as valid, weakening certif... Camunda Tasklist Camunda Zeebe Camunda Operate The application was vulnerable to CVE-2026-5588, where the PKIX CompositeVerifier in the embedded Bouncy Castle cryptography library could accept an empty signature sequence as valid, weakening certificate signature verification and potentially allowing acceptance of improperly signed certificates.

How to determine if the installation is affected

You are using:

  • Camunda Tasklist 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
  • Camunda Zeebe 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
  • Camunda Operate 8.9.0, ≤ 8.8.22, or ≤ 8.7.27

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Tasklist 8.9.1, 8.8.23, 8.7.28
  • Camunda Zeebe 8.9.1, 8.8.23, 8.7.28
  • Camunda Operate 8.9.1, 8.8.23, 8.7.28
]]> Notice 44 https://docs.camunda.io/docs/reference/notices/#notice-44 camunda-security-notice-44 Fri, 24 Apr 2026 00:00:00 GMT The application was vulnerable to CVE-2025-14813, where the GOSTCTR implementation in the embedded Bouncy Castle cryptography library used an incorrect one-byte counter and could not securely encrypt ... Camunda Tasklist Camunda Zeebe Camunda Operate The application was vulnerable to CVE-2025-14813, where the GOSTCTR implementation in the embedded Bouncy Castle cryptography library used an incorrect one-byte counter and could not securely encrypt or decrypt more than 255 blocks, potentially compromising the confidentiality and integrity of data encrypted with this algorithm.

How to determine if the installation is affected

You are using:

  • Camunda Tasklist 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
  • Camunda Zeebe 8.9.0, ≤ 8.8.22, or ≤ 8.7.27
  • Camunda Operate 8.9.0, ≤ 8.8.22, or ≤ 8.7.27

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Tasklist 8.9.1, 8.8.23, 8.7.28
  • Camunda Zeebe 8.9.1, 8.8.23, 8.7.28
  • Camunda Operate 8.9.1, 8.8.23, 8.7.28
]]> Notice 43 https://docs.camunda.io/docs/reference/notices/#notice-43 camunda-security-notice-43 Tue, 07 Apr 2026 00:00:00 GMT When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP headers will not be written. This is related to CVE-2026-22732. Management Identity Camunda Tasklist Camunda Zeebe Camunda Operate Camunda Optimize Camunda Web Modeler When applications specify HTTP response headers for servlet applications using Spring Security, there is the possibility that the HTTP headers will not be written. This is related to CVE-2026-22732.

How to determine if the installation is affected

You are using:

  • Management Identity 8.7.4 - 8.7.10, 8.7.12 - 8.7.16, 8.8.0 - 8.8.2, or 8.8.5 - 8.8.9
  • Zeebe 8.7.21 - 8.7.25
  • Tasklist 8.7.21 - 8.7.25
  • Operate 8.7.22 - 8.7.25
  • Optimize 8.7.14 - 8.7.18 or 8.8.2 - 8.8.7
  • Web Modeler Self-Managed ≤ 8.6.26, ≤ 8.7.18, or ≤ 8.8.11

Solution

Camunda has provided the following releases which contain the fix:

  • Management Identity 8.7.17, 8.8.10
  • Zeebe 8.7.26
  • Tasklist 8.7.26
  • Operate 8.7.26
  • Optimize 8.7.19, 8.8.8
  • Web Modeler Self-Managed 8.6.27, 8.7.19, 8.8.12

The fix was deployed to Web Modeler SaaS on March 23, 2026, 17:26 CET.

]]> Notice 42 https://docs.camunda.io/docs/reference/notices/#notice-42 camunda-security-notice-42 Mon, 09 Mar 2026 00:00:00 GMT The application was vulnerable to CVE-2026-24734, which allowed an attacker to bypass revocation checks of client SSL certificates if a certain server configuration was used. Management Identity The application was vulnerable to CVE-2026-24734, which allowed an attacker to bypass revocation checks of client SSL certificates if a certain server configuration was used.

How to determine if the installation is affected

You are using:

  • Management Identity ≤ 8.8.7, ≤ 8.7.14, or ≤ 8.6.27

Solution

Camunda has provided the following releases which contain the fix:

  • Management Identity 8.8.8, 8.7.15, 8.6.28
]]> Notice 41 https://docs.camunda.io/docs/reference/notices/#notice-41 camunda-security-notice-41 Mon, 09 Mar 2026 00:00:00 GMT The version of fast-xml-parser used by Camunda Web Modeler was affected by CVE-2026-26278, a vulnerability which could be exploited as a vector for denial of service attacks by forcing the parser to d... Camunda Web Modeler The version of fast-xml-parser used by Camunda Web Modeler was affected by CVE-2026-26278, a vulnerability which could be exploited as a vector for denial of service attacks by forcing the parser to do an unlimited amount of entity expansions.

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.8.8, ≤ 8.7.16, or ≤ 8.6.25

Solution

Camunda has provided the following releases that contain the fix:

  • Web Modeler Self-Managed 8.8.9, 8.7.17, 8.6.26

This issue does not affect Web Modeler SaaS.

]]> Notice 40 https://docs.camunda.io/docs/reference/notices/#notice-40 camunda-security-notice-40 Mon, 23 Feb 2026 00:00:00 GMT The version of Tomcat used by the Diagram Converter Webapp was affected by: C7 to C8 Migration Tooling The version of Tomcat used by the Diagram Converter Webapp was affected by:

How to determine if the installation is affected

You are using:

  • C7 to C8 Migration Tooling 0.2.0 AND
  • the Diagram Converter Webapp

Solution

Camunda has released the C7 to C8 Migration Tooling 0.2.1, which includes the fix.

]]> Notice 39 https://docs.camunda.io/docs/reference/notices/#notice-39 camunda-security-notice-39 Tue, 10 Feb 2026 00:00:00 GMT The version of fast-xml-parser used by Camunda Web Modeler was affected by CVE-2026-25128, a RangeError vulnerability that could crash any application that processes untrusted XML input. Camunda Web Modeler The version of fast-xml-parser used by Camunda Web Modeler was affected by CVE-2026-25128, a RangeError vulnerability that could crash any application that processes untrusted XML input.

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.8.6, ≤ 8.7.15, or ≤ 8.6.24

Solution

Camunda has provided the following releases that contain the fix:

  • Web Modeler Self-Managed 8.8.7, 8.7.16, 8.6.25

The fix was deployed to Web Modeler SaaS on February 2, 2026, 15:15 CET.

]]> Notice 38 https://docs.camunda.io/docs/reference/notices/#notice-38 camunda-security-notice-38 Thu, 08 Jan 2026 00:00:00 GMT The version of qs used by Camunda Web Modeler was affected by CVE-2025-15284, an improper input validation vulnerability that allows HTTP DoS. Camunda Web Modeler The version of qs used by Camunda Web Modeler was affected by CVE-2025-15284, an improper input validation vulnerability that allows HTTP DoS.

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.8.4, ≤ 8.7.14, or ≤ 8.6.23

Solution

Camunda has provided the following releases that contain the fix:

  • Web Modeler Self-Managed 8.8.5, 8.7.15, 8.6.24

The fix was deployed to Web Modeler SaaS on January 7, 2026, 13:45 CET.

]]> Notice 37 https://docs.camunda.io/docs/reference/notices/#notice-37 camunda-security-notice-37 Fri, 12 Dec 2025 00:00:00 GMT The application is vulnerable to CVE-2025-12183, which allows remote attackers to cause denial of service and read adjacent memory via untrusted compressed input. Camunda Tasklist Camunda Zeebe Camunda Operate The application is vulnerable to CVE-2025-12183, which allows remote attackers to cause denial of service and read adjacent memory via untrusted compressed input.

How to determine if the installation is affected

You are using:

  • Tasklist/Zeebe/Operate ≤ 8.8.6, ≤ 8.7.20, or ≤ 8.6.32

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist/Zeebe/Operate 8.8.7, 8.7.21, 8.6.33
]]> Notice 36 https://docs.camunda.io/docs/reference/notices/#notice-36 camunda-security-notice-36 Wed, 03 Dec 2025 00:00:00 GMT The application is vulnerable to CVE-2025-53066, which allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalV... Management Identity The application is vulnerable to CVE-2025-53066, which allows an unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition accessible data.

How to determine if the installation is affected

You are using:

  • Management Identity ≤ 8.8.2, ≤ 8.7.10, or ≤ 8.6.22

Solution

Camunda has provided the following releases which contain the fix:

  • Management Identity 8.8.3, 8.7.11, 8.6.23
]]> Notice 35 https://docs.camunda.io/docs/reference/notices/#notice-35 camunda-security-notice-35 Wed, 26 Nov 2025 00:00:00 GMT The embedded JDBC driver for Amazon Aurora PostgreSQL (software.amazon.jdbc:aws-advanced-jdbc-wrapper) was affected by CVE-2025-12967, which may allow for privilege escalation to the rds_superuser rol... Camunda Web Modeler Self-Managed Camunda Management Identity The embedded JDBC driver for Amazon Aurora PostgreSQL (software.amazon.jdbc:aws-advanced-jdbc-wrapper) was affected by CVE-2025-12967, which may allow for privilege escalation to the rds_superuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service (RDS) users.

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed ≤ 8.8.2, ≤ 8.7.12, or ≤ 8.6.21 with Amazon Aurora PostgreSQL
  • Management Identity ≤ 8.8.1, ≤ 8.7.9, or ≤ 8.6.21 with Amazon Aurora PostgreSQL

Solution

Camunda has provided the following releases which contain the fix:

  • Web Modeler Self-Managed 8.8.3, 8.7.13, 8.6.22
  • Management Identity 8.8.2, 8.7.10, 8.6.22
]]> Notice 34 https://docs.camunda.io/docs/reference/notices/#notice-34 camunda-security-notice-34 Tue, 11 Nov 2025 00:00:00 GMT The version of the MSSQL JDBC driver com.microsoft.sqlserver:mssql-jdbc used by Web Modeler was affected by CVE-2025-59250, which allows improper input validation that could enable an attacker to perf... Camunda Web Modeler Self-Managed The version of the MSSQL JDBC driver com.microsoft.sqlserver:mssql-jdbc used by Web Modeler was affected by CVE-2025-59250, which allows improper input validation that could enable an attacker to perform spoofing over a network.

How to determine if the installation is affected

You are using Web Modeler Self-Managed version <= 8.8.1 and Microsoft SQL Server as database vendor.

Solution

Camunda has provided the following release which contains the fix:

  • Web Modeler Self-Managed 8.8.2
]]> Notice 33 https://docs.camunda.io/docs/reference/notices/#notice-33 camunda-security-notice-33 Wed, 22 Oct 2025 00:00:00 GMT A bug in signal broadcast command processing allowed unauthorized users to trigger signal start events or signal intermediate catch events in certain process definitions without the required create or... Camunda Orchestration Cluster A bug in signal broadcast command processing allowed unauthorized users to trigger signal start events or signal intermediate catch events in certain process definitions without the required create or update permissions.

This did not allow users to access process definitions of other tenants, or leak any information about these process instances back to the unauthorized users.

How to determine if the installation is affected

You are using:

  • Orchestration Cluster 8.8.0

Solution

Camunda has provided the following release which contains the fix:

  • Orchestration Cluster 8.8.1
]]> Notice 32 https://docs.camunda.io/docs/reference/notices/#notice-32 camunda-security-notice-32 Tue, 21 Oct 2025 00:00:00 GMT The embedded Apache Tomcat was affected by CVE-2025-48989 which made Tomcat vulnerable to the MadeYouReset attack. Camunda Management Identity The embedded Apache Tomcat was affected by CVE-2025-48989 which made Tomcat vulnerable to the MadeYouReset attack.

How to determine if the installation is affected

You are using:

  • Management Identity 8.7.0 - 8.7.4 or 8.7.6 - 8.7.7

Solution

Camunda has provided the following release which contains the fix:

  • Management Identity 8.7.8
]]> Notice 31 https://docs.camunda.io/docs/reference/notices/#notice-31 camunda-security-notice-31 Thu, 16 Oct 2025 00:00:00 GMT The embedded Undertow web server was affected by CVE-2025-9784, a flaw where malformed client requests can trigger server-side stream resets without incrementing abuse counters. Camunda Web Modeler The embedded Undertow web server was affected by CVE-2025-9784, a flaw where malformed client requests can trigger server-side stream resets without incrementing abuse counters.

This issue, referred to as the "MadeYouReset" attack, allows malicious clients to induce excessive server workload by repeatedly causing server-side stream aborts and could be exploited to cause a denial of service (DoS).

How to determine if the installation is affected

You are using:

  • Web Modeler Self-Managed 8.8.0, ≤ 8.7.10, or ≤ 8.6.19

Solution

Camunda has provided the following releases which contain the fix:

  • Web Modeler Self-Managed 8.8.1, 8.7.11, 8.6.20

The fix was deployed to Web Modeler SaaS on October 14, 2025, 14:26 CET.

]]> Notice 30 https://docs.camunda.io/docs/reference/notices/#notice-30 camunda-security-notice-30 Tue, 07 Oct 2025 00:00:00 GMT The embedded Netty was affected by CVE-2025-58056, an HTTP request smuggling vulnerability in Netty. Incorrect parsing of chunked transfer encoding could allow attackers to craft malicious requests th... Camunda Tasklist Camunda Zeebe Camunda Operate Camunda Optimize Camunda Management Identity The embedded Netty was affected by CVE-2025-58056, an HTTP request smuggling vulnerability in Netty. Incorrect parsing of chunked transfer encoding could allow attackers to craft malicious requests that are interpreted inconsistently by proxies and Netty.

How to determine if the installation is affected

You are using:

  • Tasklist 8.7.0 - 8.7.12 or 8.5.0 - 8.5.22
  • Zeebe 8.7.0 - 8.7.12 or 8.5.0 - 8.5.24
  • Operate 8.7.0 - 8.7.12 or 8.5.0 - 8.5.20
  • Optimize 8.7.0 - 8.7.9 or 8.6.0 - 8.6.16
  • Management Identity 8.7.0 - 8.7.6 or 8.6.0 - 8.6.19 or 8.5.0 - 8.5.21

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist 8.7.13, 8.5.23
  • Zeebe 8.7.13, 8.5.25
  • Operate 8.7.13, 8.5.21
  • Optimize 8.7.10, 8.6.17
  • Management Identity 8.7.7, 8.6.20, 8.5.22
]]> Notice 29 https://docs.camunda.io/docs/reference/notices/#notice-29 camunda-security-notice-29 Fri, 03 Oct 2025 00:00:00 GMT Zeebe may be affected by CVE-2024-41996, which allows remote attackers to trigger expensive server-side DHE modular-exponentiation calculations, potentially causing asymmetric resource consumption and... Camunda Zeebe Zeebe may be affected by CVE-2024-41996, which allows remote attackers to trigger expensive server-side DHE modular-exponentiation calculations, potentially causing asymmetric resource consumption and DoS attacks.

How to determine if the installation is affected

You are potentially affected if you have configured Zeebe to accept DHE or ECDHE cipher suites through the server.ssl.ciphers property or SERVER_SSL_CIPHERS environment variable.

Default Zeebe installations are not affected.

Solution

Configure the server.ssl.ciphers property or SERVER_SSL_CIPHERS environment variable to exclude DHE and ECDHE cipher suites. For example:

server.ssl.ciphers=TLS_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_256_CBC_SHA

There is no known mitigation other than disabling the use of DHE and ECDHE cipher suites.

]]> Notice 28 https://docs.camunda.io/docs/reference/notices/#notice-28 camunda-security-notice-28 Tue, 09 Sep 2025 00:00:00 GMT Optimize was affected by CVE-2025-5115, which allows a remote attacker to repeatedly send malformed HTTP/2 frames that exhaust a Jetty server’s CPU and memory, causing a denial-of-service. Camunda Optimize Optimize was affected by CVE-2025-5115, which allows a remote attacker to repeatedly send malformed HTTP/2 frames that exhaust a Jetty server’s CPU and memory, causing a denial-of-service.

How to determine if the installation is affected

You are using:

  • Optimize 8.7.0 - 8.7.8 or 8.6.0 - 8.6.15

Solution

Camunda has provided the following releases which contain the fix:

  • Optimize 8.7.9, 8.6.16
]]> Notice 27 https://docs.camunda.io/docs/reference/notices/#notice-27 camunda-security-notice-27 Wed, 27 Aug 2025 00:00:00 GMT Optimize's email functionality was affected by CVE-2025-7962, which allowed for SMTP injection by providing forged email recipient addresses that could lead to malicious content being sent to arbitrar... Camunda Optimize Optimize's email functionality was affected by CVE-2025-7962, which allowed for SMTP injection by providing forged email recipient addresses that could lead to malicious content being sent to arbitrary recipients.

How to determine if the installation is affected

You are using:

  • Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

  • Optimize 8.7.8, 8.6.15
]]> Notice 26 https://docs.camunda.io/docs/reference/notices/#notice-26 camunda-security-notice-26 Wed, 27 Aug 2025 00:00:00 GMT Optimize was affected by CVE-2025-53864 which allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion. Camunda Optimize Optimize was affected by CVE-2025-53864 which allows a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set, because of uncontrolled recursion.

How to determine if the installation is affected

You are using:

  • Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

  • Optimize 8.7.8, 8.6.15
]]> Notice 25 https://docs.camunda.io/docs/reference/notices/#notice-25 camunda-security-notice-25 Wed, 27 Aug 2025 00:00:00 GMT The embedded Apache Tomcat was affected by CVE-2025-48989 which made Tomcat vulnerable to the MadeYouReset attack. Camunda Tasklist Camunda Zeebe Camunda Operate Camunda Optimize The embedded Apache Tomcat was affected by CVE-2025-48989 which made Tomcat vulnerable to the MadeYouReset attack.

How to determine if the installation is affected

You are using:

  • Tasklist 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.20
  • Zeebe 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24
  • Operate 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.18
  • Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist 8.7.11, 8.6.25, 8.5.21
  • Zeebe 8.7.11, 8.6.25
  • Operate 8.7.11, 8.6.25, 8.5.19
  • Optimize 8.7.8, 8.6.15
]]> Notice 24 https://docs.camunda.io/docs/reference/notices/#notice-24 camunda-security-notice-24 Wed, 27 Aug 2025 00:00:00 GMT The embedded Netty was affected by CVE-2025-55163 which allows malformed HTTP/2 control frames usage that results in resource exhaustion and distributed denial of service. Camunda Tasklist Camunda Zeebe Camunda Operate Camunda Management Identity Camunda Optimize The embedded Netty was affected by CVE-2025-55163 which allows malformed HTTP/2 control frames usage that results in resource exhaustion and distributed denial of service.

How to determine if the installation is affected

You are using:

  • Tasklist 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.20
  • Zeebe 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.22
  • Operate 8.7.0 - 8.7.10 or 8.6.0 - 8.6.24 or 8.5.0 - 8.5.18
  • Management Identity 8.7.0 - 8.7.5 or 8.6.0 - 8.6.18 or 8.5.0 - 8.5.19
  • Optimize 8.7.0 - 8.7.7 or 8.6.0 - 8.6.14

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist 8.7.11, 8.6.25, 8.5.21
  • Zeebe 8.7.11, 8.6.25, 8.5.23
  • Operate 8.7.11, 8.6.25, 8.5.19
  • Management Identity 8.7.6, 8.6.19, 8.5.20
  • Optimize 8.7.8, 8.6.15
]]> Notice 23 https://docs.camunda.io/docs/reference/notices/#notice-23 camunda-security-notice-23 Thu, 31 Jul 2025 00:00:00 GMT The embedded Spring Boot Tomcat was affected by CVE-2025-53506 which allowed for uncontrolled resource consumption that could be used to exhaust system resources in a potential DoS (denial of service)... Camunda Tasklist Camunda Zeebe Camunda Operate Camunda Management Identity Camunda Optimize The embedded Spring Boot Tomcat was affected by CVE-2025-53506 which allowed for uncontrolled resource consumption that could be used to exhaust system resources in a potential DoS (denial of service) attack.

How to determine if the installation is affected

You are using:

  • Tasklist 8.7.0 - 8.7.8 or 8.6.0 - 8.6.22 or 8.5.0 - 8.5.18
  • Zeebe 8.7.0 - 8.7.8 or 8.6.0 - 8.6.22
  • Operate 8.7.0 - 8.7.8 or 8.6.0 - 8.6.22 or 8.5.0 - 8.5.16
  • Management Identity 8.7.0 - 8.7.4 or 8.6.0 - 8.6.17 or 8.5.0 - 8.5.18
  • Optimize 8.7.0 - 8.7.6 or 8.6.0 - 8.6.12

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist 8.7.9, 8.6.23, 8.5.19
  • Zeebe 8.7.9, 8.6.23
  • Operate 8.7.9, 8.6.23, 8.5.17
  • Management Identity 8.7.5, 8.6.18, 8.5.19
  • Optimize 8.7.7, 8.6.13
]]> Notice 22 https://docs.camunda.io/docs/reference/notices/#notice-22 camunda-security-notice-22 Thu, 31 Jul 2025 00:00:00 GMT Part of our RESTful API that supported multipart file uploads was affected by CVE-2025-52520, which could lead to potential DoS (denial of service) attacks. Camunda Tasklist Camunda Zeebe Camunda Operate Part of our RESTful API that supported multipart file uploads was affected by CVE-2025-52520, which could lead to potential DoS (denial of service) attacks.

How to determine if the installation is affected

You are using:

  • Tasklist 8.6.0 - 8.6.22 or 8.7.0 - 8.7.8
  • Zeebe 8.6.0 - 8.6.22 or 8.7.0 - 8.7.8
  • Operate 8.6.0 - 8.6.22 or 8.7.0 - 8.7.8

Solution

Camunda has provided the following releases which contain the fix:

  • Tasklist 8.6.22
  • Tasklist 8.7.9
  • Zeebe 8.6.23
  • Zeebe 8.7.9
  • Operate 8.6.23
  • Operate 8.7.9
]]> Notice 21 https://docs.camunda.io/docs/reference/notices/#notice-21 camunda-security-notice-21 Wed, 18 Jun 2025 00:00:00 GMT The version of org.postgresql:postgresql used by Camunda Web Modeler Self-Managed was affected by CVE-2025-49146 potentially allowing a man-in-the-middle attacker to intercept connections when the Pos... Camunda Web Modeler Self-Managed The version of org.postgresql:postgresql used by Camunda Web Modeler Self-Managed was affected by CVE-2025-49146 potentially allowing a man-in-the-middle attacker to intercept connections when the PostgreSQL JDBC driver was configured with channel binding set to required.

How to determine if the installation is affected

You are using Camunda Web Modeler Self-Managed version 8.6.0 - 8.6.12, or 8.7.0 - 8.7.3.

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Web Modeler Self-Managed 8.6.12
  • Camunda Web Modeler Self-Managed 8.7.3
]]> Notice 20 https://docs.camunda.io/docs/reference/notices/#notice-20 camunda-security-notice-20 Tue, 17 Jun 2025 00:00:00 GMT Camunda Optimize was affected by a vulnerability that allowed an attacker to gain improper access to Optimize data by using a modified JWT (JSON Web Token). Camunda Optimize Camunda Optimize was affected by a vulnerability that allowed an attacker to gain improper access to Optimize data by using a modified JWT (JSON Web Token).

How to determine if the installation is affected

You are using Camunda Optimize ≤ 8.6.9 or ≤ 8.7.2.

Solution

Camunda has provided the following release which contains a fix:

]]> Notice 19 https://docs.camunda.io/docs/reference/notices/#notice-19 camunda-security-notice-19 Wed, 21 May 2025 00:00:00 GMT The version of nodejs used by Camunda Web Modeler was affected by CVE-2025-23166 potentially allowing an adversary to remotely crash the Node.js runtime. Camunda Web Modeler The version of nodejs used by Camunda Web Modeler was affected by CVE-2025-23166 potentially allowing an adversary to remotely crash the Node.js runtime.

How to determine if the installation is affected

You are using Camunda Web Modeler Self-Managed version ≤ 8.4.17, ≤ 8.5.18, ≤ 8.6.10, or ≤ 8.7.1.

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Web Modeler Self-Managed 8.4.18
  • Camunda Web Modeler Self-Managed 8.5.19
  • Camunda Web Modeler Self-Managed 8.6.11
  • Camunda Web Modeler Self-Managed 8.7.2

The fix was deployed to Web Modeler SaaS on May 19, 2025, 15:10 CET.

]]> Notice 18 https://docs.camunda.io/docs/reference/notices/#notice-18 camunda-security-notice-18 Tue, 08 Apr 2025 00:00:00 GMT Camunda Optimize was affected by a vulnerability that allowed an attacker to modify a JWT (JSON Web Token) so that they would be given improper access to Optimize. Camunda Optimize Camunda Optimize was affected by a vulnerability that allowed an attacker to modify a JWT (JSON Web Token) so that they would be given improper access to Optimize.

How to determine if the installation is affected

You are using Camunda Optimize ≤ 8.4.15, ≤ 8.5.12, ≤ 8.6.6, ≤ 8.7.0, ≤ 3.11.20, ≤ 3.12.15, ≤ 3.13.12, ≤ 3.14.3, ≤ 3.15.1.

Solution

Camunda has provided the following release which contains a fix:

  • Camunda Optimize 8.4.16, 8.5.13, 8.6.7, 8.7.0, 3.12.16, 3.13.13, 3.14.4, 3.15.2
]]> Notice 17 https://docs.camunda.io/docs/reference/notices/#notice-17 camunda-security-notice-17 Tue, 08 Apr 2025 00:00:00 GMT When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash. Camunda Zeebe When parsing unknown fields in the Protobuf Java Lite and Full library, a maliciously crafted message can cause a StackOverflow error and lead to a program crash.

  • As Zeebe makes extensive use of Protobuf, this could lead to denial-of-service (DoS) issues on the server side.
  • This issue allows an attacker to send specific payloads that will always result in StackOverflowException. This could lead to Zeebe Gateway performance issues and affect system availability.
  • Although the Zeebe Gateway will not crash, it will spend more time working on these requests. An attacker could use this opportunity to slow it down and make it unusable by sending a large number of requests within a short time frame.

No data is leaked, lost, or corrupted. This issue only affects application availability.

Learn more about this CVE at the GitHub Advisory Database.

How to determine if the installation is affected

You are using Camunda Zeebe 8.6.11.

Solution

Camunda has provided the following release which contains a fix:

]]> Notice 16 https://docs.camunda.io/docs/reference/notices/#notice-16 camunda-security-notice-16 Fri, 14 Mar 2025 00:00:00 GMT Some Camunda Zeebe versions were affected by a vulnerability that allowed a malicious attacker to craft network packets that could crash the Zeebe Gateway. Camunda Zeebe Some Camunda Zeebe versions were affected by a vulnerability that allowed a malicious attacker to craft network packets that could crash the Zeebe Gateway.

How to determine if the installation is affected

You are using Camunda Zeebe 8.6.0 - 8.6.11

Solution

Camunda has provided the following release which contains a fix:

]]> Notice 15 https://docs.camunda.io/docs/reference/notices/#notice-15 camunda-security-notice-15 Tue, 11 Mar 2025 00:00:00 GMT Some Camunda Optimize versions were affected by a vulnerability that allowed a malicious attacker to craft Camunda URLs that could execute JavaScript code. Camunda Optimize Some Camunda Optimize versions were affected by a vulnerability that allowed a malicious attacker to craft Camunda URLs that could execute JavaScript code.

How to determine if the installation is affected

You are using Camunda Optimize ≤ 8.6.5.

Solution

Camunda has provided the following release which contains a fix:

]]> Notice 14 https://docs.camunda.io/docs/reference/notices/#notice-14 camunda-security-notice-14 Tue, 11 Mar 2025 00:00:00 GMT The version of koa used by Camunda Web Modeler was affected by the following vulnerability: Camunda Web Modeler The version of koa used by Camunda Web Modeler was affected by the following vulnerability:

How to determine if the installation is affected

You are using Camunda Web Modeler Self-Managed version ≤ 8.3.16, ≤ 8.4.14, ≤ 8.5.15, or ≤ 8.6.7.

Solution

Camunda has provided the following releases which contain the fix:

  • Camunda Web Modeler Self-Managed 8.3.17
  • Camunda Web Modeler Self-Managed 8.4.15
  • Camunda Web Modeler Self-Managed 8.5.16
  • Camunda Web Modeler Self-Managed 8.6.8

The fix was deployed to Web Modeler SaaS on February 14, 2025, 08:50 CET.

]]> Notice 13 https://docs.camunda.io/docs/reference/notices/#notice-13 camunda-security-notice-13 Thu, 18 Jul 2024 00:00:00 GMT The version of Apache Tomcat used by Camunda Management Identity was affected by the following vulnerability: Camunda Management Identity The version of Apache Tomcat used by Camunda Management Identity was affected by the following vulnerability:

How to determine if the installation is affected

You are using Camunda Management Identity version 8.5.3 or previous.

Solution

Camunda has provided the following release which contains a fix:

  • Camunda Management Identity 8.5.4
]]> Notice 12 https://docs.camunda.io/docs/reference/notices/#notice-12 camunda-security-notice-12 Tue, 03 Oct 2023 00:00:00 GMT The version of libwebp shipped with Camunda Desktop Modeler was affected by the following vulnerability: Camunda Desktop Modeler The version of libwebp shipped with Camunda Desktop Modeler was affected by the following vulnerability:

How to determine if the installation is affected

You are using Camunda Desktop Modeler version 5.15.1 or previous.

Solution

Camunda has provided the following release which contains a fix:

]]> Notice 11 https://docs.camunda.io/docs/reference/notices/#notice-11 camunda-security-notice-11 Mon, 17 Apr 2023 00:00:00 GMT The Tasklist REST API functionality of Tasklist 8.2.0 and 8.2.1 allows unauthenticated access to the following methods/URLs: Tasklist The Tasklist REST API functionality of Tasklist 8.2.0 and 8.2.1 allows unauthenticated access to the following methods/URLs:

  • GET /v1/tasks/{taskId}
  • POST /v1/tasks/search
  • POST /v1/tasks/{taskId}/variables/search
  • POST /v1/forms/{formId}
  • POST /v1/variables/{variableId}

Find more information about the methods in our Tasklist REST API documentation.

Therefore, if you use Tasklist 8.2.0 or 8.2.1, and if you have sensible data stored in process variables (accessed by user tasks), this data could have been accessed by users knowing the endpoint of the Tasklist instance without authentication.

How to determine if the installation is affected

You are using Tasklist version 8.2.0 or 8.2.1.

Solution

Camunda has provided the following releases which contain a fix

]]> Notice 10 https://docs.camunda.io/docs/reference/notices/#notice-10 camunda-security-notice-10 Thu, 10 Nov 2022 00:00:00 GMT The Tasklist Docker image contain an OpenSSL version 3.0.2 for which the following CVEs have been published: Tasklist The Tasklist Docker image contain an OpenSSL version 3.0.2 for which the following CVEs have been published:

At this point, Camunda is not aware of any specific attack vector in Tasklist allowing attackers to exploit the vulnerability but recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are Tasklist version (8.0.3 ≥ version ≤ 8.0.7) or ≤ 8.1.2

Solution

Camunda has provided the following releases which contain a fix

]]> Notice 9 https://docs.camunda.io/docs/reference/notices/#notice-9 camunda-security-notice-9 Mon, 11 Apr 2022 00:00:00 GMT Zeebe, Operate, Tasklist and IAM are using the Spring framework for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2022-22965 Zeebe, Operate, Tasklist, IAM Zeebe, Operate, Tasklist and IAM are using the Spring framework for which the following CVE has been published: https://nvd.nist.gov/vuln/detail/CVE-2022-22965

At this point, Camunda is not aware of any specific attack vector in Zeebe, Operate, Tasklist or IAM allowing attackers to exploit the vulnerability but recommends applying fixes as mentioned in the Solution section below.

How to determine if the installation is affected

You are using Zeebe, Operate or Tasklist version ≤ 1.2.11 or ≤ 1.3.6

Solution

Camunda has provided the following releases which contain a fix

]]>