CVE-2026-65655
LowCVSS 2.3Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue access-token cookies, and refresh-token cookies when provided by the identity provider, without Secure even though the browser completed login over HTTPS.
Risk Assessment
A victim who visits attacker-controlled content while a credential remains live may expose that credential only if the attacker can also steer traffic for the UI hostname, prevent the browser's HTTPS connection from succeeding, serve the hostname over HTTP, and read a later same-site plaintext request. Effective HSTS or TLS re-encryption between the proxy and Temporal UI Server prevents the demonstrated disclosure path.
Recommendation
Upgrade Temporal UI Server to a version that correctly sets the Secure attribute based on the browser connection, or configure TLS re-encryption between the proxy and the server.
Related vulnerabilities
- CVE-2026-106102Critical
Quasar Framework before 2.22.0 has a vulnerability in the SSR-only getHead() serializer that fails to properly encode values supplied via useMeta(). An attacker who can influence dynamic page metadata can inject executable HTML markup before hydration. The client-side path is not affected because it uses DOM APIs that encode attributes.
- CVE-2026-105863Critical
Payload CMS in versions after 3.0.0 and before 3.90.0 allows a custom field option that maps a field to a reserved authentication claim name to place unintended values in the authentication token issued at login. This issue is fixed in version 3.90.0.
- CVE-2026-105859Critical
Payload CMS before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to modify collection documents without enforcing collection or field-level access control when orderable is enabled. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-105857Critical
The @payloadcms/plugin-form-builder plugin in versions before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability that allows an attacker to execute code remotely on the server via a crafted form submission. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-105851Critical
Payload CMS in versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34 has a vulnerability in the duplicate operation that copies values from a source document even when a field is hidden or its access.read/access.create rule rejects that value for the caller. The disableDuplicate setting does not prevent this access-control bypass. This issue is fixed in versions 3.90.0 and 4.0.0-canary.34.
- CVE-2026-104070Critical
The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php. Attackers can chain this flaw to write a malicious .html skeleton file, disclose sensitive configuration files containing the site secret, and forge a signed ajax context to execute the uploaded skeleton, achieving arbitrary PHP code execution as the web-server user.
- CVE-2026-67273Critical
Dell Container Storage Modules before version 1.18.0 contain an Improper Neutralization of Special Elements Used in a Template Engine vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to elevation of privileges.
- CVE-2026-105845Critical
Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an untrusted user who can query readable collections through dynamic filters or joins to submit a request that causes SQL injection in the SQLite and Postgres adapters. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- CVE-2026-105844Critical
Payload CMS in versions from 3.0.0 before 3.88.0 and canary versions before 4.0.0-canary.27 has a vulnerability that allows an unauthenticated user to submit prototype-sensitive field paths when @payloadcms/plugin-import-export is enabled, causing unintended application behavior that can lead to remote code execution. This issue is fixed in versions 3.88.0 and 4.0.0-canary.27.
- CVE-2026-67269Critical
Dell Container Storage Modules (CSM) Operator prior to version 1.18.0 contains an Improper Privilege Management vulnerability in the ContainerStorageModule Custom Resource reconciler. A low privileged remote attacker could exploit this vulnerability to escalate privileges and gain root-level access on cluster nodes.
Original NVD description (English source)
When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue access-token cookies, and refresh-token cookies when provided by the identity provider, without Secure even though the browser completed login over HTTPS. A victim who visits attacker-controlled content while a credential remains live may expose that credential only if the attacker can also steer traffic for the UI hostname, prevent the browser's HTTPS connection from succeeding, serve the hostname over HTTP, and read a later same-site plaintext request. A malicious website alone cannot read the cookie, and passive observation of a successful TLS connection is insufficient. Effective HSTS, a blocking HTTPS-only warning, or TLS re-encryption between the proxy and Temporal UI Server prevents the demonstrated disclosure path. A recovered credential may be replayed within the victim's assigned permissions. Refresh-token replay additionally depends on the identity provider's issuance, expiry, rotation, and reuse-detection behavior.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS