Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Vendor: Temporal Clear all filters
TI-2025-13669 CVE-2025-14986 · GHSA-p2gr-hm8g-q772

ExecuteMultiOperation Namespace Policy Bypass

Priority LOW 14

When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, aut…

CVSS 4.0LOW 1.3 Network Low privileges No interaction EPSS 0.00426 Published 2025-12-30 Fixed in 1.27.4, 1.28.2 +1 CWE-863
TI-2025-13670 CVE-2025-14987 · GHSA-hmhp-gh8m-c8xp

Cross Namespace Commands Authorization Bypass

Priority LOW 30

When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00401 Published 2025-12-30 Fixed in 1.27.4, 1.28.2 +2 CWE-863
TI-2025-07683 CVE-2025-8396 · GHSA-p768-c3pr-6459

Resource allocation without limits in Temporal OSS Server

Priority LOW 37

Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of…

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00388 Published 2025-09-15 Fixed in 1.26.3, 1.27.3 +1 CWE-770
TI-2023-03253 CVE-2023-3485 · GHSA-gm2g-2xr9-pxxj

Insecure Default Authorization in Temporal Server

Priority LOW 16

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request.

CVSS 3.1LOW 3.6 Local Low privileges No interaction EPSS 0.00166 Published 2023-06-30 Fixed in 1.20, 1.20.0 CWE-1188