CIB seven 2.2.4 CE+ - Release Notes

Release Date: October 17, 2026

Highlights

• Security The task filter expression whitelist is now enabled by default
• Security The initial setup that creates the first administrator is now only offered on an unconfigured engine
• Security AI Agent Connector chat memory is now persisted as a process variable, so a conversation can no longer be read from another process instance and survives engine restarts and replicas
• Security Process descriptions and warning messages are now rendered as text instead of HTML, closing a stored cross-site scripting (XSS) issue
• Security 14 CVEs resolved (1 Critical, 6 High, 6 Medium, 1 Low) in jackson (jackson-core, jackson-databind), lz4-java, freemarker, and zlib, through the dependency and Alpine base image updates below
• Variables Users with read-only permissions can now view variable values without entering edit mode, and Bytes variables can be downloaded and uploaded as files
• Direct Provider Fixed paging, runtime instance counts, the user operation log, and process instance termination when the webclient accesses the engine directly
• Logging The engine now uses SLF4J 2

Breaking Changes

• The task filter expression whitelist is now enabled by default. Task filter expressions outside the whitelist are rejected with HTTP 400. In the Tasklist, a stored filter that uses such an expression shows an error instead of the task list. See Patch Level Update for how to find affected filters before updating
• The initial setup that creates the first administrator is now only offered while the identity service is writable, holds no users, groups or authorizations, and no administrators are configured besides camunda-admin. An installation that has users, groups or authorizations but no administrator no longer gets the setup and must configure its administrator via admin-user or adminUsers. A fresh database still gets the setup
• An AI Agent Connector memoryId is now scoped to one process instance: it no longer continues a conversation in another process instance, including one started by a call activity. A memoryId may be at most 222 characters long
• The engine now manages SLF4J 2 (slf4j-api 2.0.18, logback 1.5.38) instead of SLF4J 1.7. Applications that embed the engine with an SLF4J 1.x binding must switch to an SLF4J 2 provider, e.g. log4j-slf4j2-impl instead of log4j-slf4j-impl. The CIB seven Run distributions already used SLF4J 2

Configuration Changes

• The default of the process engine property enableFilterExpressionWhitelist changed from false to true. Setting it to false restores the previous behavior (not recommended). Use allowedFilterExpressions to allow additional expressions
• New AI Agent Connector property cibseven.connect.ai-agent.chatMemoryVariable.enabled (environment variable CIBSEVEN_CONNECT_AI_AGENT_CHAT_MEMORY_VARIABLE_ENABLED, default true). Setting it to false restores the JVM-local chat memory store and with it the cross-instance disclosure (not recommended)
• New AI Agent Connector property cibseven.connect.ai-agent.chatMemoryMaxPayloadBytes limits the size of the persisted chat memory (default 1 MiB)
• The unused, deprecated webclient permission keys deleteProcessInstance and deleteHistoricProcessInstance were removed from config.json, the built-in defaults and the Helm values. Configurations that still contain them are not affected

New Features

Variables

• In the Variables tab of a process instance, each variable now offers either Edit or View. View opens the variable dialog read-only, so users with read permissions only can inspect variable values without entering an editable state. Add, Edit, Upload and Delete are shown only with the matching permission
• Variables of type Bytes are no longer shown as null; their value can now be downloaded and uploaded as a file, with the file name sanitized

Tasklist on Mobile Devices

• Optimized the task list, filter panel and task header navigation for mobile devices: selecting a filter now opens its task list and closes the filter panel in one step

User Experience Improvements

Authorizations

• Batch authorizations now offer the CREATE_BATCH_DELETE_DEPLOYMENTS and CREATE_BATCH_CORRELATE_MESSAGE permissions; the misspelled UDPATE entry was removed

Preferences

• The number format setting for BPMN diagrams is now shown only to users with Cockpit access, with user-specific DENY authorizations correctly overriding group-wide GRANT authorizations

Bug Fixes

Security

• Task filter JUEL expressions could still invoke arbitrary functions, methods or beans unless the whitelist introduced in 2.2.2 was enabled explicitly. It is now enabled by default and also accepts the expressions suggested by the Tasklist filter dialog
• The first-run setup could create a new administrator without any login on an engine that was already administered (administrators configured via adminUsers / adminGroups or granted through authorizations) but had an empty or missing camunda-admin group. The Admin app’s setup and the engine REST setup endpoint used by the webclient now share a single check that only allows the setup on an unconfigured engine. Engines using the LDAP plugin remain excluded
• Process descriptions and warning messages are now rendered as text instead of HTML, so crafted content in a deployed BPMN model can no longer execute script in the browser of users who open it
• The webclient no longer logs the full authentication response, including the token, to the browser console after login

AI Agent Connector

• The chat memory was a JVM-wide map keyed only by memoryId, so another user could read a conversation by reusing its memoryId in a different process instance; conversations were also lost on restart and not shared between replicas. The conversation is now stored in the process variable cibseven-connect-ai-agent-memory_<memoryId> at process instance scope
• Concurrent branches that share one memoryId now log a warning, and AgentChatMemoryStore.clear() now fails outside an engine command instead of silently clearing only an in-memory buffer

Variables

• Fixed deleting a historic variable requiring a permission the engine does not have, so only users with ALL saw the button; it now requires DELETE_HISTORY on the process definition
• Deleting a runtime variable now requires the same permissions as the engine: UPDATE_VARIABLE or UPDATE on the process instance, or UPDATE_INSTANCE_VARIABLE or UPDATE_INSTANCE on the process definition
• Process instance authorizations are now matched against the process instance id; previously only grants on * were taken into account
• The “Stop instance” button now requires DELETE on the process instance or DELETE_INSTANCE on the process definition, as the engine does

Tasklist

• Fixed creating a filter with comma-separated “Candidate groups” failing with HTTP 500
• Fixed the filter counter counting tasks that the task list then hid; the list now shows all tasks returned by the engine without an additional client-side permission check

Process Instances

• Fixed the activity-scoped incidents list being empty for external task incidents
• Fixed the list of called process instances and definitions being incomplete

Direct Provider

• Fixed incident and external task queries ignoring firstResult / maxResults and returning the full result set; on a process definition with many incidents this could crash the browser tab with an out-of-memory error
• Fixed the runtime process instance count returning the number of historic process instances
• Fixed the user operation log not being written when engine authorization is disabled
• Stopping a process instance now marks it as externally terminated, as with the REST provider, so the process instance search offers to delete its history
• Fixed an error when opening a historic process instance, runtime results not keeping the runtime query’s order, and incidents not being loaded for runtime process instances

LDAP

• Fixed LdapUserProvider never closing the LDAP directory contexts and search results it opened during login, user lookup and token verification. Each open context kept a socket and a reader thread alive, consuming memory outside the Java heap that counts against the container limit

Spring Configuration

• Removed a duplicate PropertySourcesPlaceholderConfigurer bean from the webclient’s Spring context. Spring Boot registers its own, and the second bean caused property placeholders to fall back to the Environment and prevented applications from declaring their own placeholder configurer

Technical Updates

Dependency Updates

• Update jackson (jackson-core, jackson-databind) from 2.21.5 to 2.21.7, resolving multiple vulnerabilities (see Resolved CVE Vulnerabilities below)
• Update jackson 3 from 3.1.5 to 3.1.7
• Update the jackson-core and jackson-databind modules bundled with WildFly (main slot) from 2.21.5 to 2.21.7 (WildFly distribution)
• Update lz4-java from 1.11.1 to 1.11.4 (WildFly distribution), resolving multiple vulnerabilities (see Resolved CVE Vulnerabilities below)
• Update freemarker from 2.3.31 to 2.3.35, fixing CVE-2026-84939
• Update slf4j-api from 1.7.26 to 2.0.18
• Update logback from 1.2.13 to 1.5.38
• Update springdoc-openapi from 2.8.13 to 2.9.1 (Spring Boot 3) and from 3.0.2 to 3.0.3 (Spring Boot 4)
• Update swagger-ui from 5.32.6 to 5.32.14
• Update zlib from 1.3.2-r0 to 1.3.2-r1 (Alpine base image), fixing CVE-2026-85091

Resolved CVE Vulnerabilities

Critical Severity

• CVE-2026-84939 - Path traversal in Apache FreeMarker’s template loading when an attacker can supply a malformed locale identifier and localized lookup is enabled, which it is by default. Affects org.freemarker:freemarker. - CVSS 9.1.

High Severity

• CVE-2026-106451 - Vulnerability in lz4-java fixed in version 1.11.4. Affects at.yawk.lz4:lz4-java. - CVSS 7.0.
• CVE-2026-68497 - An unauthenticated attacker can send a request of a few megabytes with an oversized Duration value (e.g. P followed by several million digits and Y) to force tens of seconds to several minutes of single-threaded CPU work per request, so a handful of concurrent requests can saturate the server. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 7.5.
• CVE-2026-89407 - Attacker-supplied JSON deserialized into a numeric type (BigDecimal, BigInteger, Double, Float) reaches a vulnerable number-parsing method through jackson-databind’s default String-to-number coercion. Affects com.fasterxml.jackson.core:jackson-core. - CVSS 7.5.
• CVE-2026-89425 - UTF8DataInputJsonParser._reportInvalidToken() builds the offending-token text for its error message in a loop with no upper bound. Affects com.fasterxml.jackson.core:jackson-core. - CVSS 7.5.
• CVE-2026-91776 - TypeDeserializerBase._findDeserializer() caches resolved deserializers under the raw, attacker-supplied type ID. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 7.5.
• CVE-2026-91777 - Vulnerability exploitable when an application deserializes attacker-influenced JSON into an identity-enabled collection or map. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 7.5.

Medium Severity

• CVE-2026-106450 - LZ4FrameInputStream.readHeader() allocates two new 4 MiB block buffers for every maximum-block-size frame header, so an attacker-controlled stream of many minimal empty frames triggers excessive memory allocation. Affects at.yawk.lz4:lz4-java. - CVSS 5.3.
• CVE-2026-106452 - LZ4BlockInputStream.refill() allocates a compressed-input buffer of the attacker-controlled size from a legacy block header before reading any payload, so a header-only stream can request a near-2 GiB allocation. Affects at.yawk.lz4:lz4-java. - CVSS 5.3.
• CVE-2026-106453 - LZ4DecompressorWithLength trusts the four-byte decompressed-length header before validating the compressed input, so a five-byte input can request up to approximately 2 GiB and exhaust the JVM heap. Affects at.yawk.lz4:lz4-java. - CVSS 5.3.
• CVE-2026-19032 - The deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 5.3.
• CVE-2026-83557 - Attacker-controlled input can instantiate objects, e.g. a java.io.File for an arbitrary path, which becomes path-traversal-adjacent if the application then calls path-sensitive methods on the value. Affects com.fasterxml.jackson.core:jackson-databind. - CVSS 5.6.
• CVE-2026-85091 - Heap buffer overflow in gz_vacate() when processing non-blocking gzwrite() operations with stale external buffer pointers (zlib 1.3.1.2 through 1.3.2). Affects zlib.

Low Severity

• CVE-2026-106449 - LZ4BlockInputStream with stopOnEmptyBlock set to false recursively calls refill() for each empty block, so a long sequence of empty blocks in an attacker-controlled stream can exhaust the decoding thread’s stack. Affects at.yawk.lz4:lz4-java. - CVSS 3.7.