Vulnerabilities

TI-2026-59955 CVE-2026-87858 · GHSA-vrgw-vghm-5p74

Temporal Server completion callback source header can direct attacker-chosen requests to…

LOW 33

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00779 Published 2026-09-21 Fixed in 1.30.7, 1.31.3 CWE-807

TI-2026-13897 CVE-2026-16651 · GHSA-g9jq-gq4v-4rw3

temporalio/sqlparser malformed MySQL version comments can cause a panic

MEDIUM 44

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00532 Published 2026-09-21 Fixed in 0.0.0-20260721183040-74181ffcbaaf, 1.30.7 +1 CWE-129

TI-2026-13898 CVE-2026-16652 · GHSA-pv35-7w89-v65c

Temporal Server Schedule exclusion search can cause excessive CPU consumption

LOW 32

Temporal Server did not bound the work performed while searching for a Schedule's next action time.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00466 Published 2026-09-21 Fixed in 1.30.7, 1.31.3 CWE-606

Vulnerabilities

Filters

Temporal Server completion callback source header can direct attacker-chosen requests to…

temporalio/sqlparser malformed MySQL version comments can cause a panic

Temporal Server Schedule exclusion search can cause excessive CPU consumption