CIB seven 2.0.14 EE - Release Notes

Release Date: October 17, 2026

Security Task filter JUEL expressions are now restricted to a safe whitelist, enabled by default
Security The initial setup that creates the first administrator is now only offered on an unconfigured engine
Security Process and task names are now rendered as text instead of HTML, closing a stored cross-site scripting (XSS) issue
Security 9 CVEs resolved (1 Critical, 5 High, 3 Medium) in jackson (jackson-core, jackson-databind), freemarker, and zlib, through the dependency and Alpine base image updates below
LDAP Fixed LdapUserProvider leaking LDAP connections, which could exhaust container memory
REST API Documentation Fixed the webclient’s /v3/api-docs endpoint returning HTTP 500, which left Swagger UI without an API description

Task filter expressions outside the whitelist are now rejected with HTTP 400. In the Tasklist, a stored filter that uses such an expression shows an error instead of the task list. See Patch Level Update for how to find affected filters before updating
The initial setup page that creates the first administrator is now only offered while the identity service is writable, holds no users, groups or authorizations, and no administrators are configured besides camunda-admin. An installation that has users, groups or authorizations but no administrator no longer gets the setup page and must configure its administrator via admin-user or adminUsers. A fresh database still gets the setup page

New process engine property enableFilterExpressionWhitelist (default true). Setting it to false restores the previous behavior (not recommended)
New process engine property allowedFilterExpressions: a semicolon-separated list of allowed task filter expressions. It replaces the defaults, so include the defaults you still need. In CIB seven Run / Spring Boot, set it via camunda.bpm.generic-properties.properties.allowedFilterExpressions

Task filter JUEL expressions (e.g. assigneeExpression) were evaluated with full JUEL power and no content validation, allowing arbitrary function, method or bean invocation for anyone authorized to create or execute filters. Expressions are now restricted to a whitelist: currentUser(), currentUserGroups(), now(), a set of dateTime() expressions (including those suggested by the Tasklist filter dialog), and plain literal values. The whitelist applies to stored filters, ad-hoc task queries and or() query branches
The first-run setup could create a new administrator without any login on an engine that was already administered (administrators configured via adminUsers / adminGroups or granted through authorizations) but had an empty or missing camunda-admin group. The Admin app’s setup now shares a single check that only allows the setup on an unconfigured engine. Engines using the LDAP plugin remain excluded
Process and task names are now rendered as text instead of HTML, so a crafted name in a deployed BPMN model can no longer execute script in the browser of users who open it
The webclient no longer logs the full authentication response, including the token, to the browser console after login

Fixed LdapUserProvider never closing the LDAP directory contexts and search results it opened during login, user lookup and token verification. Each open context kept a socket and a reader thread alive, consuming memory outside the Java heap that counts against the container limit

Fixed the webclient’s /v3/api-docs endpoint returning HTTP 500, which left Swagger UI without an API description

Removed a duplicate PropertySourcesPlaceholderConfigurer bean from the webclient’s Spring context. Spring Boot registers its own, and the second bean caused property placeholders to fall back to the Environment and prevented applications from declaring their own placeholder configurer

Update jackson (jackson-core, jackson-databind) from 2.21.5 to 2.21.7, resolving multiple vulnerabilities (see Resolved CVE Vulnerabilities below)
Update jackson 3 from 3.1.5 to 3.1.7
Update freemarker from 2.3.31 to 2.3.35, fixing CVE-2026-84939
Update springdoc-openapi from 2.8.13 to 2.9.1
Update zlib from 1.3.2-r0 to 1.3.2-r1 (Alpine base image), fixing CVE-2026-85091

CVE-2026-84939 - Path traversal in Apache FreeMarker’s template loading when an attacker can supply a malformed locale identifier and localized lookup is enabled, which it is by default. Affects org.freemarker:freemarker. - CVSS 9.1.

CVE-2026-68497 - An unauthenticated attacker can send a request of a few megabytes with an oversized Duration value (e.g. P followed by several million digits and Y) to force tens of seconds to several minutes of single-threaded CPU work per request, so a handful of concurrent requests can saturate the server. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 7.5.
CVE-2026-89407 - Attacker-supplied JSON deserialized into a numeric type (BigDecimal, BigInteger, Double, Float) reaches a vulnerable number-parsing method through jackson-databind’s default String-to-number coercion. Affects com.fasterxml.jackson.core:jackson-core. - CVSS 7.5.
CVE-2026-89425 - UTF8DataInputJsonParser._reportInvalidToken() builds the offending-token text for its error message in a loop with no upper bound. Affects com.fasterxml.jackson.core:jackson-core. - CVSS 7.5.
CVE-2026-91776 - TypeDeserializerBase._findDeserializer() caches resolved deserializers under the raw, attacker-supplied type ID. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 7.5.
CVE-2026-91777 - Vulnerability exploitable when an application deserializes attacker-influenced JSON into an identity-enabled collection or map. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 7.5.

CVE-2026-19032 - The deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 5.3.
CVE-2026-83557 - Attacker-controlled input can instantiate objects, e.g. a java.io.File for an arbitrary path, which becomes path-traversal-adjacent if the application then calls path-sensitive methods on the value. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 5.6.
CVE-2026-85091 - Heap buffer overflow in gz_vacate() when processing non-blocking gzwrite() operations with stale external buffer pointers (zlib 1.3.1.2 through 1.3.2). Affects zlib.