Read the docs

Temporal

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

Temporal records in CISA KEV

No Temporal vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Temporal 1 record LOW

Records

4 records

TI-2025-07683 CVE-2025-8396 · GHSA-p768-c3pr-6459

Resource allocation without limits in Temporal OSS Server

Priority LOW 37

Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00388 Published 2025-09-15 Fixed in 1.26.3, 1.27.3 +1 CWE-770
TI-2025-13670 CVE-2025-14987 · GHSA-hmhp-gh8m-c8xp

Cross Namespace Commands Authorization Bypass

Priority LOW 30

When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00401 Published 2025-12-30 Fixed in 1.27.4, 1.28.2 +2 CWE-863
TI-2023-03253 CVE-2023-3485 · GHSA-gm2g-2xr9-pxxj

Insecure Default Authorization in Temporal Server

Priority LOW 16

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request.

CVSS 3.1LOW 3.6 Local Low privileges No interaction EPSS 0.00166 Published 2023-06-30 Fixed in 1.20, 1.20.0 CWE-1188
TI-2025-13669 CVE-2025-14986 · GHSA-p2gr-hm8g-q772

ExecuteMultiOperation Namespace Policy Bypass

Priority LOW 14

When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, aut…

CVSS 4.0LOW 1.3 Network Low privileges No interaction EPSS 0.00426 Published 2025-12-30 Fixed in 1.27.4, 1.28.2 +1 CWE-863
Open these records in search →