Skip to contentTemporal Technologies, Inc. Temporal vulnerabilities
- temporal technologies, inc. serverTemporal Server workflow-history pagination token is not bound to the requested namespace and workflowCVE-2026-878575.3 Medium
- temporal technologies, inc. serverTemporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service hostCVE-2026-1200918.7 High
- temporal technologies, inc. temporal-proxytemporal-proxy payload decryption is not bound to the request namespaceCVE-2026-1081266.0 Medium
- temporal technologies, inc. serverTemporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule stateCVE-2026-891406.0 Medium
- temporal technologies, inc. serverTemporal Server applies inbound namespace replication from a connected peer cluster to local namespacesCVE-2026-1043557.0 High
- temporal technologies, inc. serverTemporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service hostCVE-2026-891398.7 High
- temporal technologies, inc. serverTemporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorizationCVE-2026-878587.2 High
- temporal technologies, inc. temporalio/ringpop-gotemporalio/ringpop-go fails to enforce configured label limits on inbound membership gossipCVE-2026-656548.7 High
- temporal technologies, inc. temporalio/tchannel-gotemporalio/tchannel-go zero-chunk call fragment causes process terminationCVE-2026-656538.7 High
- temporal technologies, inc. temporalio/tchannel-gotemporalio/tchannel-go malformed checksum type causes process terminationCVE-2026-656528.7 High
- temporal technologies, inc. server, temporalio/sqlparser +1 moretemporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversalCVE-2026-656518.7 High
- temporal technologies, inc. server, temporalio/sqlparser +1 moretemporalio/sqlparser malformed MySQL version comments can cause a panicCVE-2026-166518.7 High
- temporal technologies, inc. serverTemporal Server Schedule exclusion search can cause excessive CPU consumptionCVE-2026-166527.1 High
- temporal technologies, inc. ui serverTemporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxyCVE-2026-656552.3 Low
- temporal technologies, inc. temporalMissing Authentication on Streaming gRPC Replication EndpointCVE-2026-5724Public exploitFix available6.3 Medium
- temporal technologies, inc. temporalCross Namespace Access via Batch OperationCVE-2026-5199Fix available2.3 Low
- temporalExecuteMultiOperation Namespace Policy BypassCVE-2025-14986Fix available1.3 Low
- temporalCross Namespace Commands Authorization BypassCVE-2025-14987Fix available5.3 Medium
- temporal technologies, inc. serverDenial of Service if invalid UTF-8 sentCVE-2024-2689Fix available4.4 Medium
- temporal, temporal technologies inc. server +1 moreInsecure Default Authorization in Temporal ServerCVE-2023-3485Fix available3.0 Low