Read the docs
TI-2026-13898 Aliases CVE-2026-16652GHSA-pv35-7w89-v65c

Temporal Server Schedule exclusion search can cause excessive CPU consumption

Priority LOW 32CWE-606Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00466 40th percentileScored 2026-11-07
Fix Fixed Temporal Server (Temporal Technologies, Inc.): 1.30.7, 1.31.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Temporal Technologies, Inc.Temporal Server1.17.0 – 1.29.7; 1.30.0 to before 1.30.7; 1.31.0 to before 1.31.31.30.7, 1.31.3Patch availableCNA
  • Temporal Server VendorTemporal Technologies, Inc. Affected 1.17.0 – 1.29.7; 1.30.0 to before 1.30.7; 1.31.0 to before 1.31.3 Fixed in 1.30.7, 1.31.3 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*——Temporal
  • cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:* Versions — — ·Temporal

Remediation

  • Fix · CNA Temporal Server (Temporal Technologies, Inc.) Fixed in 1.30.7, 1.31.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Temporal Server 1.30.7, 1.31.3

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2026-13897 temporalio/sqlparser malformed MySQL version comments can cause a panicPriority MEDIUM 44
    • TI-2026-59955 Temporal Server completion callback source header can direct attacker-chosen requests to…Priority LOW 33
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-16652
  2. 2026-10-03 Alias added: GHSA-pv35-7w89-v65c

References

Patch 2

Other 2

  • TI-2026-63861 s2s-proxy accepts untrusted client certificates CVSS 4.0CRITICAL 9.3
  • TI-2026-46800 temporalio/tchannel-go zero-chunk call fragment causes process termination CVSS 4.0HIGH 8.7
  • TI-2026-46799 temporalio/tchannel-go malformed checksum type causes process termination CVSS 4.0HIGH 8.7
  • TI-2026-46801 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip CVSS 4.0HIGH 8.7
  • TI-2026-13897 temporalio/sqlparser malformed MySQL version comments can cause a panic CVSS 4.0HIGH 8.7
  • TI-2026-84119 Temporal Server k8s compute provider lets callers run host commands CVSS 4.0HIGH 8.7
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences