TI-2026-05020 Aliases CVE-2026-5724 GHSA-q98v-9f9w-f49q

Missing Authentication on Streaming gRPC Replication Endpoint

LOW 29CWE-306Published 2026-04-10 · Updated 2026-07-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: Present
Impact type: Security bypass
Confidentiality · integrity · availability: Low · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-306.

Summary

The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests without credentials. This endpoint is registered on the same port as WorkflowService and cannot be disabled independently. An attacker with network access to the frontend port could open the replication stream without authentication. Data exfiltration is possible, but only when a configured replication target is correctly configured and the attacker has knowledge of the cluster configuration, as the history service validates cluster IDs and peer membership before returning replication data. The fix was applied per release line: it is present in 1.28.4, 1.29.6, 1.30.4, 1.31.2, and 1.32.0 and later releases on each line. Releases 1.31.0 and 1.31.1 do not contain the fix and are affected. Temporal Cloud is not affected.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00606 49th percentileScored 2026-11-07

Fix Fixed temporal (Temporal Technologies, Inc.): 1.28.4, 1.29.6, 1.30.4 +1go.temporal.io/server (Go): 1.28.4, 1.29.6, 1.30.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Temporal Technologies, Inc.	temporal	1.24.0 to before 1.28.4; 1.29.0 to before 1.29.6; 1.30.0 to before 1.30.4; 1.31.0 to before 1.31.2	1.28.4, 1.29.6, 1.30.4, 1.31.2	Patch available	CNA
—	go.temporal.io/server (Go)	before 1.28.4	1.28.4	Patch available	GHSA-q98v-9f9w-f49q
—	go.temporal.io/server (Go)	1.29.0-135.0 to before 1.29.6	1.29.6	Patch available	GHSA-q98v-9f9w-f49q
—	go.temporal.io/server (Go)	1.30.0-143.0 to before 1.30.4	1.30.4	Patch available	GHSA-q98v-9f9w-f49q

temporal VendorTemporal Technologies, Inc. Affected 1.24.0 to before 1.28.4; 1.29.0 to before 1.29.6; 1.30.0 to before 1.30.4; 1.31.0 to before 1.31.2 Fixed in 1.28.4, 1.29.6, 1.30.4, 1.31.2 Patch available CNA
go.temporal.io/server (Go) Vendor— Affected before 1.28.4 Fixed in 1.28.4 Patch available GHSA-q98v-9f9w-f49q
go.temporal.io/server (Go) Vendor— Affected 1.29.0-135.0 to before 1.29.6 Fixed in 1.29.6 Patch available GHSA-q98v-9f9w-f49q
go.temporal.io/server (Go) Vendor— Affected 1.30.0-143.0 to before 1.30.4 Fixed in 1.30.4 Patch available GHSA-q98v-9f9w-f49q

Remediation

Fix · CNA temporal (Temporal Technologies, Inc.) Fixed in 1.28.4, 1.29.6, 1.30.4, 1.31.2
Fix · GHSA-q98v-9f9w-f49q go.temporal.io/server (Go) Fixed in 1.28.4 Advisory →
Fix · GHSA-q98v-9f9w-f49q go.temporal.io/server (Go) Fixed in 1.29.6 Advisory →
Fix · GHSA-q98v-9f9w-f49q go.temporal.io/server (Go) Fixed in 1.30.4 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-5724
2026-10-03 Alias added: GHSA-q98v-9f9w-f49q
2026-10-04 EPSS moved to the 50th–90th percentile
2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 4

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-5724

Other 1

https://github.com/temporalio/temporal

TI-2026-63861 s2s-proxy accepts untrusted client certificates CVSS 4.0CRITICAL 9.3
TI-2026-46800 temporalio/tchannel-go zero-chunk call fragment causes process termination CVSS 4.0HIGH 8.7
TI-2026-46799 temporalio/tchannel-go malformed checksum type causes process termination CVSS 4.0HIGH 8.7
TI-2026-46801 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip CVSS 4.0HIGH 8.7
TI-2026-13897 temporalio/sqlparser malformed MySQL version comments can cause a panic CVSS 4.0HIGH 8.7
TI-2026-84119 Temporal Server k8s compute provider lets callers run host commands CVSS 4.0HIGH 8.7

See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences