Read the docs
TI-2025-13670 Aliases CVE-2025-14987GHSA-hmhp-gh8m-c8xp

Cross Namespace Commands Authorization Bypass

Priority LOW 30CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace. This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00401 34th percentileScored 2026-11-07
Fix Fixed go.temporal.io/server (Go): 1.27.4, 1.28.2, 1.29.2 +1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TemporalTemporalup to 1.29.1; up to 1.28.1; up to 1.27.3—No fix listedCNA
—go.temporal.io/server (Go)before 1.27.41.27.4Patch availableGHSA-hmhp-gh8m-c8xp
—go.temporal.io/server (Go)1.28.0 to before 1.28.21.28.2Patch availableGHSA-hmhp-gh8m-c8xp
—go.temporal.io/server (Go)1.29.0 to before 1.29.21.29.2Patch availableGHSA-hmhp-gh8m-c8xp
—go.temporal.io/server (Go)1.29.0-0 to before 1.29.0-135.0.0.20251218190115-b292a32bacdf1.29.0-135.0.0.20251218190115-b292a32bacdfPatch availableGHSA-hmhp-gh8m-c8xp
  • Temporal VendorTemporal Affected up to 1.29.1; up to 1.28.1; up to 1.27.3 Fixed in — No fix listed CNA
  • go.temporal.io/server (Go) Vendor— Affected before 1.27.4 Fixed in 1.27.4 Patch available GHSA-hmhp-gh8m-c8xp
  • go.temporal.io/server (Go) Vendor— Affected 1.28.0 to before 1.28.2 Fixed in 1.28.2 Patch available GHSA-hmhp-gh8m-c8xp
  • go.temporal.io/server (Go) Vendor— Affected 1.29.0 to before 1.29.2 Fixed in 1.29.2 Patch available GHSA-hmhp-gh8m-c8xp
  • go.temporal.io/server (Go) Vendor— Affected 1.29.0-0 to before 1.29.0-135.0.0.20251218190115-b292a32bacdf Fixed in 1.29.0-135.0.0.20251218190115-b292a32bacdf Patch available GHSA-hmhp-gh8m-c8xp

Remediation

  • Fix · GHSA-hmhp-gh8m-c8xp go.temporal.io/server (Go) Fixed in 1.27.4 Advisory →
  • Fix · GHSA-hmhp-gh8m-c8xp go.temporal.io/server (Go) Fixed in 1.28.2 Advisory →
  • Fix · GHSA-hmhp-gh8m-c8xp go.temporal.io/server (Go) Fixed in 1.29.2 Advisory →
  • Fix · GHSA-hmhp-gh8m-c8xp go.temporal.io/server (Go) Fixed in 1.29.0-135.0.0.20251218190115-b292a32bacdf Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14987
  2. 2026-10-03 Alias added: GHSA-hmhp-gh8m-c8xp

References

Advisory 1

Other 5

  • TI-2025-07683 Resource allocation without limits in Temporal OSS Server CVSS 4.0MEDIUM 6.9
  • TI-2023-03253 Insecure Default Authorization in Temporal Server CVSS 3.1LOW 3.6
  • TI-2025-13669 ExecuteMultiOperation Namespace Policy Bypass CVSS 4.0LOW 1.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences