Read the docs
TI-2025-01063 Aliases CVE-2025-1243GHSA-q9w6-cwj4-gf4p

Field in api-go proxy not transformed before version 1.44.1

Priority LOW 9CWE-311Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-311.

Summary

The Temporal api-go library prior to version 1.44.1 did not send `update response` information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the `update response` field not having Data Converter transformations (e.g. encryption) applied. This is an issue only when using the UpdateWorkflowExecution APIs (released on 13th January 2025) with a proxy leveraging the api-go library before version 1.44.1. Other data fields were correctly sent to Data Converter. This issue does not impact the Data Converter server. Data was encrypted in transit. Temporal Cloud services are not impacted.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00093 0th percentileScored 2026-11-07
Fix Fixed api-go library (Temporal Technologies, Inc.): 1.44.1go.temporal.io/api (Go): 1.44.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Temporal Technologies, Inc.api-go librarybefore 1.44.11.44.1Patch availableCNA
—go.temporal.io/api (Go)before 1.44.11.44.1Patch availableGHSA-q9w6-cwj4-gf4p
  • api-go library VendorTemporal Technologies, Inc. Affected before 1.44.1 Fixed in 1.44.1 Patch available CNA
  • go.temporal.io/api (Go) Vendor— Affected before 1.44.1 Fixed in 1.44.1 Patch available GHSA-q9w6-cwj4-gf4p

Remediation

  • Fix · CNA api-go library (Temporal Technologies, Inc.) Fixed in 1.44.1
  • Fix · GHSA-q9w6-cwj4-gf4p go.temporal.io/api (Go) Fixed in 1.44.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1243
  2. 2026-10-03 Alias added: GHSA-q9w6-cwj4-gf4p

References

Advisory 1

Other 4

  • TI-2026-63861 s2s-proxy accepts untrusted client certificates CVSS 4.0CRITICAL 9.3
  • TI-2026-46800 temporalio/tchannel-go zero-chunk call fragment causes process termination CVSS 4.0HIGH 8.7
  • TI-2026-46799 temporalio/tchannel-go malformed checksum type causes process termination CVSS 4.0HIGH 8.7
  • TI-2026-46801 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip CVSS 4.0HIGH 8.7
  • TI-2026-13897 temporalio/sqlparser malformed MySQL version comments can cause a panic CVSS 4.0HIGH 8.7
  • TI-2026-84119 Temporal Server k8s compute provider lets callers run host commands CVSS 4.0HIGH 8.7
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences