Authorization bypass in Temporal Server
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-639.
Summary
Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callbacks that Scheduler V2 attaches to the Workflows it starts. In affected releases, any authenticated caller could attach a callback with that address to a Workflow start request, the address was exempt from the component.callbacks.allowedAddresses allowlist, and the History service delivered the callback to the component its token named, in whatever namespace that was, without authorizing the original caller there. When the forged completion matches an action a target schedule is running, the schedule records the action as completed while its Workflow still runs, which can defeat an overlap policy such as SKIP, and passes caller-controlled data to the next scheduled Workflow as its last completion result. A forged failure may also pause a schedule configured to pause on failure. A forgery requires the target namespace identifier, the schedule identifier, and the identity and timing of a running action. No disclosure of Workflow payloads or history was identified. Only namespaces that hold Scheduler V2 schedules can be targeted; Scheduler V2 is off by default, and existing Scheduler V2 schedules remain targets after the settings that create them are turned off.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Temporal Technologies, Inc. | Temporal Server | 1.30.0 to before 1.30.8 | 1.30.8 | Patch available | CNA |
| Temporal Technologies, Inc. | Temporal Server | 1.31.0 to before 1.31.4 | 1.31.4 | Patch available | CNA |
| Temporal Technologies, Inc. | Temporal Server | 1.32.0 to before 1.32.1 | 1.32.1 | Patch available | CNA |
- Temporal Server VendorTemporal Technologies, Inc. Affected 1.30.0 to before 1.30.8 Fixed in 1.30.8 Patch available CNA
- Temporal Server VendorTemporal Technologies, Inc. Affected 1.31.0 to before 1.31.4 Fixed in 1.31.4 Patch available CNA
- Temporal Server VendorTemporal Technologies, Inc. Affected 1.32.0 to before 1.32.1 Fixed in 1.32.1 Patch available CNA
Remediation
- Fix · CNA Temporal Server (Temporal Technologies, Inc.) Fixed in 1.30.8
- Fix · CNA Temporal Server (Temporal Technologies, Inc.) Fixed in 1.31.4
- Fix · CNA Temporal Server (Temporal Technologies, Inc.) Fixed in 1.32.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Ansible Automation Orchestrator 2026 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-12 Threatist record created from CVE-2026-89140
- 2026-10-13 Alias added: GHSA-fmmr-q3xv-r2hc
- 2026-10-13 Priority changed: MEDIUM → LOW
- 2026-10-16 CISA SSVC decision points changed
- 2026-11-04 Affected versions changed · Red Hat
- 2026-11-04 CVSS score added · Red Hat
References
Patch 7
More Temporal Technologies, Inc. vulnerabilities
- TI-2026-63861 s2s-proxy accepts untrusted client certificates CVSS 4.0CRITICAL 9.3
- TI-2026-46800 temporalio/tchannel-go zero-chunk call fragment causes process termination CVSS 4.0HIGH 8.7
- TI-2026-46799 temporalio/tchannel-go malformed checksum type causes process termination CVSS 4.0HIGH 8.7
- TI-2026-46801 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip CVSS 4.0HIGH 8.7
- TI-2026-13897 temporalio/sqlparser malformed MySQL version comments can cause a panic CVSS 4.0HIGH 8.7
- TI-2026-84119 Temporal Server k8s compute provider lets callers run host commands CVSS 4.0HIGH 8.7
Sources
- CVE-2026-89140 · CVE Program
- CVE-2026-89140 · NVD
- FIRST EPSS
- GHSA-fmmr-q3xv-r2hc · GitHub Advisory Database · CC BY 4.0
- CVE-2026-89140 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences