CVE-2026-16652
HighCVSS 7.1Summary
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule combining a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing excessive CPU consumption in Frontend and Schedule worker components.
Risk Assessment
An attacker can cause a denial of service through excessive CPU consumption, and a persisted specification can cause repeated retries and resource consumption without additional requests. The issue affects availability only.
Recommendation
Update Temporal Server to a version containing the search work budget fix. Restrict namespace write permissions and monitor for Schedules with unusual configurations.
Other vulnerabilities in Temporal Server
See all- CVE-2026-89139High
Temporal Server vulnerability allows an authenticated user with write access to a single namespace to execute arbitrary commands on the host running the Worker Service. The command is executed immediately, and since the Worker Service process holds credentials and TLS material for the entire cluster, the impact escalates to full cluster compromise. Affected versions are 1.31.0 through 1.31.2 (before 1.31.3), and the issue is present in default binaries and container images.
- CVE-2026-87858High
Temporal Server in releases 1.30.0 and later decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller with write permission in a single namespace could attach a callback whose 'source' header caused the request to be re-targeted at the internal frontend and executed as a system administrator against the administrative API. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect requiring the header to match a configured cluster ID.
- CVE-2026-5724Medium
The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. Configured ClaimMapper and Authorizer were bypassed for the AdminService/StreamWorkflowReplicationMessages endpoint, allowing unauthenticated access.
- CVE-2023-3485Low
Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allow an attacker to craft a task token with access to a namespace other than the one specified in the request. This requires the namespace UUID and information from the workflow history for the target namespace.
Original NVD description (English source)
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.