CVE-2026-89139
HighCVSS 8.7Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
Temporal Server vulnerability allows an authenticated user with write access to a single namespace to execute arbitrary commands on the host running the Worker Service. The command is executed immediately, and since the Worker Service process holds credentials and TLS material for the entire cluster, the impact escalates to full cluster compromise. Affected versions are 1.31.0 through 1.31.2 (before 1.31.3), and the issue is present in default binaries and container images.
Risk Assessment
An attacker can take over the Worker Service and thus the entire Temporal cluster, as the process has access to sensitive credentials for all namespaces. This could lead to full system and data compromise.
Recommendation
It is recommended to immediately upgrade Temporal Server to version 1.31.3 or later if you are running 1.31.0–1.31.2. Additionally, if an upgrade is not possible, configure the compute provider allowlist (workercontroller.compute_providers.enabled) to exclude the "subprocess" provider and ensure the value is explicitly set.
Other vulnerabilities in Temporal Server
See all- CVE-2026-120091High
Temporal Server includes a Worker Controller Instance module (go.temporal.io/auto-scaled-workers) that registers a 'k8s' compute provider which builds its Kubernetes client from the caller's request configuration rather than operator configuration. An authenticated caller with only read access in a single namespace can invoke ValidateWorkerDeploymentVersionComputeConfig, leading to arbitrary command execution on the Worker Service host under the server process account. Since the process holds persistence credentials for all namespaces and cluster TLS material, the impact extends beyond the caller's namespace to the entire cluster.
- CVE-2026-89140Medium
Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callbacks that Scheduler V2 attaches to the Workflows it starts. In affected releases, any authenticated caller could attach a callback with that address to a Workflow start request, the address was exempt from the component.callbacks.allowedAddresses allowlist, and the History service delivered the callback to the component its token named, in whatever namespace that was, without authorizing the original caller there. When the forged completion matches an action a target schedule is running, the schedule records the action as completed while its Workflow still runs, which can defeat an overlap policy such as SKIP, and passes caller-controlled data to the next scheduled Workflow as its last completion result. A forged failure may also pause a schedule configured to pause on failure. A forgery requires the target namespace identifier, the schedule identifier, and the identity and timing of a running action. No disclosure of Workflow payloads or history was identified. Only namespaces that hold Scheduler V2 schedules can be targeted; Scheduler V2 is off by default, and existing Scheduler V2 schedules remain targets after the settings that create them are turned off.
- CVE-2026-104355High
A vulnerability in Temporal Server allows a connected peer cluster to modify local namespaces in the receiving cluster, which should not be replicated. The receiving cluster does not check if the namespace is global and overwrites its state, description, owner, retention, archival settings, cluster list, and active cluster if the task carries a higher failover version. An attacker controlling a registered peer's replies can change any local namespace without credentials on the receiving cluster, e.g., marking it Deprecated, causing new Workflow starts to fail.
- CVE-2026-87858High
Temporal Server in releases 1.30.0 and later decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller with write permission in a single namespace could attach a callback whose 'source' header caused the request to be re-targeted at the internal frontend and executed as a system administrator against the administrative API. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect requiring the header to match a configured cluster ID.
- CVE-2026-16652High
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule combining a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing excessive CPU consumption in Frontend and Schedule worker components.
- CVE-2026-5724Medium
The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. Configured ClaimMapper and Authorizer were bypassed for the AdminService/StreamWorkflowReplicationMessages endpoint, allowing unauthenticated access.
- CVE-2023-3485Low
Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allow an attacker to craft a task token with access to a namespace other than the one specified in the request. This requires the namespace UUID and information from the workflow history for the target namespace.
Original NVD description (English source)
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that provider executes are taken from the compute provider configuration supplied in the caller's request rather than from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore configure a worker deployment version so that the Worker Service executes a command of the caller's choosing on its own host, under the account the server process runs as. Execution is immediate rather than deferred: the configuration handler invokes every provider using the invoke strategy directly after validating the submitted specification, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The only control that can keep it unreachable is the compute provider allowlist, the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled, and that control does not deny by default: its default value is an unset list, and the allowlist check is skipped entirely when the value is unset, so every registered compute provider is permitted, this one included. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is 1.31.0 or later and earlier than 1.31.3. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective per-namespace value of workercontroller.compute_providers.enabled is either unset or contains subprocess. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Note that the separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path. It defaults to false, and a deployment that has never set it in any namespace is still affected, which was confirmed by running an affected release with no value for that setting present anywhere in dynamic configuration. To look for a compute configuration that is already attached, call DescribeWorkerDeploymentVersion for each worker deployment version in each namespace and check whether any scaling group's compute provider type is subprocess.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS