The class BaseMinaTaskServer (https://github.com/Salaboy/jbpm/blob/master/jbpm-human-task/src/main/java/org/jbpm/task/service/mina/BaseMinaTaskServer.java) currently binds 127.0.0.1 for listening connections, and it is not configurable, so it only accepts local connections.

Line 70: acceptor.bind( new InetSocketAddress( "127.0.0.1", port ) );