TI-2023-03253 Aliases CVE-2023-3485 GHSA-gm2g-2xr9-pxxj

Insecure Default Authorization in Temporal Server

LOW 16CWE-1188Published 2023-06-30 · Updated 2024-10-28

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: None · Low · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires the namespace UUID and information from the workflow history for the target namespace. Under these conditions, it is possible to interfere with pending tasks in other namespaces, such as marking a task failed or completed. If a task is targeted for completion by the attacker, the targeted namespace must also be using the same data converter configuration as the initial, valid, namespace for the task completion payload to be decoded by workers in the target namespace.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00166 5th percentileScored 2026-11-07

Fix Fixed Temporal Server (Temporal Technologies Inc.): 1.20go.temporal.io/server (Go): 1.20.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Temporal Technologies, Inc.	Temporal Server	1.9.1 to before 1.20	1.20	Patch available	CNA
—	go.temporal.io/server (Go)	before 1.20.0	1.20.0	Patch available	GHSA-gm2g-2xr9-pxxj

Temporal Server VendorTemporal Technologies, Inc. Affected 1.9.1 to before 1.20 Fixed in 1.20 Patch available CNA
go.temporal.io/server (Go) Vendor— Affected before 1.20.0 Fixed in 1.20.0 Patch available GHSA-gm2g-2xr9-pxxj

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:temporal:temporal::::::::	before 1.20.0	Vulnerable	Temporal

cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:* Versions before 1.20.0 Vulnerable ·Temporal

Remediation

Fix · CNA Temporal Server (Temporal Technologies Inc.) Fixed in 1.20
Fix · GHSA-gm2g-2xr9-pxxj go.temporal.io/server (Go) Fixed in 1.20.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2023-3485
2026-10-03 Alias added: GHSA-gm2g-2xr9-pxxj

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2023-3485

Other 2

TI-2026-63861 s2s-proxy accepts untrusted client certificates CVSS 4.0CRITICAL 9.3
TI-2026-46800 temporalio/tchannel-go zero-chunk call fragment causes process termination CVSS 4.0HIGH 8.7
TI-2026-46799 temporalio/tchannel-go malformed checksum type causes process termination CVSS 4.0HIGH 8.7
TI-2026-46801 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip CVSS 4.0HIGH 8.7
TI-2026-13897 temporalio/sqlparser malformed MySQL version comments can cause a panic CVSS 4.0HIGH 8.7
TI-2026-84119 Temporal Server k8s compute provider lets callers run host commands CVSS 4.0HIGH 8.7

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences