Temporal

Latest CVEs · RSS

• CVE-2026-108126 2026-10-15 · CVSS 6.0
  temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy choo
• CVE-2026-89140 2026-10-12 · CVSS 6.0
  Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in o
• CVE-2026-104355 2026-10-12 · CVSS 7.0
  A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies
• CVE-2026-96770 2026-09-23 · CVSS 9.3
  All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skip
• CVE-2026-89139 2026-09-21 · CVSS 8.7
  Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose functi
• CVE-2026-87858 2026-09-21 · CVSS 7.2
  Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write
• CVE-2026-65654 2026-09-21 · CVSS 8.7
  github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply
• CVE-2026-65653 2026-09-21 · CVSS 8.7
  github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reade
• CVE-2026-65652 2026-09-21 · CVSS 8.7
  github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener ca
• CVE-2026-65651 2026-09-21 · CVSS 8.7
  temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an appl
• CVE-2026-16651 2026-09-21 · CVSS 8.7
  temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to fiv
• CVE-2026-16652 2026-09-21 · CVSS 7.1
  Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission coul
• CVE-2026-65655 2026-08-11 · CVSS 2.3
  When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected v
• CVE-2026-5724 2026-04-10 · CVSS 6.3
  The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RP
• CVE-2026-5199 2026-04-01 · CVSS 2.3
  A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Exploi
• CVE-2025-14986 2025-12-30 · CVSS 1.3
  When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecution
• CVE-2025-14987 2025-12-30 · CVSS 5.3
  When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecutio
• CVE-2025-8396 2025-09-15 · CVSS 6.9
  Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory
• CVE-2025-1243 2025-02-12 · CVSS 2.0
  The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go module
• CVE-2024-2689 2024-04-03 · CVSS 4.4
  Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and
• CVE-2024-2435 2024-04-02 · CVSS 4.3
  For an attacker with pre-existing access to send a signal to a workflow, the attacker can make the signal name a script that executes when a victim views that s
• CVE-2023-3485 2023-06-30 · CVSS 3.0
  Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other