CVE-2026-87858
HighCVSS 7.2Summary
Temporal Server in releases 1.30.0 and later decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller with write permission in a single namespace could attach a callback whose 'source' header caused the request to be re-targeted at the internal frontend and executed as a system administrator against the administrative API. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect requiring the header to match a configured cluster ID.
Risk Assessment
An attacker with write permission in one namespace can, without network access to the internal frontend, perform administrative operations in other namespaces, including terminating Workflows, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The absence of internal frontend log entries is not evidence that the issue was not exploited.
Recommendation
Check whether the static configuration sets a non-zero services.internal-frontend.rpc.httpPort and whether the effective per-namespace dynamic configuration value of component.callbacks.allowedAddresses contains any rule admitting a host. If both conditions are met and authorization is enabled, upgrade Temporal Server to a patched release or disable the internal frontend with its HTTP API enabled, and review existing callbacks using DescribeWorkflowExecution.
Other vulnerabilities in Temporal Server
See all- CVE-2026-89139High
Temporal Server vulnerability allows an authenticated user with write access to a single namespace to execute arbitrary commands on the host running the Worker Service. The command is executed immediately, and since the Worker Service process holds credentials and TLS material for the entire cluster, the impact escalates to full cluster compromise. Affected versions are 1.31.0 through 1.31.2 (before 1.31.3), and the issue is present in default binaries and container images.
- CVE-2026-16652High
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule combining a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing excessive CPU consumption in Frontend and Schedule worker components.
- CVE-2026-5724Medium
The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. Configured ClaimMapper and Authorizer were bypassed for the AdminService/StreamWorkflowReplicationMessages endpoint, allowing unauthenticated access.
- CVE-2023-3485Low
Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allow an attacker to craft a task token with access to a namespace other than the one specified in the request. This requires the namespace UUID and information from the workflow history for the target namespace.
Original NVD description (English source)
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving the caller's path, query, and request body. Where an internal frontend is deployed with its HTTP API enabled, that client resolves to the internal frontend, which authorizes every request as a system administrator without requiring authentication information. The result is that the server performs an attacker-chosen state-changing HTTP POST against its own administrative API on the caller's behalf, in namespaces where the caller has no permission. The caller never needs network access to the internal frontend, because the History service makes the request. Confirmed effects include terminating Workflows in other namespaces, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The affected routing logic is present in both the HSM and CHASM callback delivery implementations. This description and the CVSS score in this record describe releases 1.30.0 and later, where any non-empty source header is sufficient. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect in which the header must exactly match a configured cluster ID, a UUID that a namespace-scoped caller cannot read through the API. The consequence once that match occurs is the same, but the attack is materially harder and scores lower. To determine whether a deployment is affected, check two settings together: the static Server configuration for a non-zero services.internal-frontend.rpc.httpPort, and the effective per-namespace dynamic configuration value of component.callbacks.allowedAddresses. A deployment is exposed only when an internal frontend is deployed with a non-zero HTTP port, at least one allowlist rule admits a host, and authorization is enabled. The allowlist is empty by default, which denies all external callback URLs, and the stock static topology does not include an internal frontend. Note that a failed attach returns the error 'invalid url: url does not match any configured callback address', which proves only that one tested URL did not match and does not prove the effective allowlist is empty. To look for callbacks already attached, use DescribeWorkflowExecution, which returns callback information for a Workflow's registered completion callbacks. Operators should be aware of a gap when searching for evidence of delivery: the frontend HTTP API server records the request method and URL at debug level only, so at default log levels a delivered request is not written to the internal frontend's logs, and the absence of such log entries is not evidence that the issue was not exploited.