Temporal Proxy CVE-2026-108126

Exploitation requires that payload encryption be ENABLED on the proxy and that a single proxy be configured with keys for more than one namespace (the flaw is irrelevant for single-namespace deployments or when encryption is off). The attacker must already be authorized for a target namespace B and must have obtained, out of band, a ciphertext encrypted for a different namespace A - the issue does not grant access to any ciphertext the attacker could not already acquire. Two delivery paths exist: on 0.8.0, posting the payload to the codec server's /decode endpoint; on every affected version, writing the payload into namespace B on the Temporal server and reading it back through the proxy. Limiting/mitigating factors: the fix (v0.9.0) introduces namespace binding, and running the codec server in 'strict' mode causes /decode to refuse payloads labeled for a different namespace (400), so deployments on the fixed version in strict mode are not exposed; impact is confined to confidentiality (payloads cannot be altered).

This is a genuine but bounded authorization/access-control flaw (CWE-639) rated Medium (CVSS 4.0 base 6.0). The vendor-supplied 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H) is internally consistent with the description: network-reachable, but requiring an already-authorized namespace-B caller (PR:L) plus a specific precondition captured by AT:P - the attacker must already possess an encrypted payload from namespace A. Impact is confidentiality-only (VC:H, VI:N/VA:N), matching the explicit statement that payloads cannot be modified and that no new ciphertext is exposed that the attacker could not already obtain. EPSS, KEV, SSVC, and POC signals are all ABSENT from the input rather than negative: no CISA KEV listing, no public exploit code, and no EPSS probability to corroborate likelihood - so real-world exploitation likelihood cannot be quantified from the data given. The combination of required authorization, a required out-of-band ciphertext, and confidentiality-only impact places this as a legitimate priority for multi-tenant Temporal deployments that rely on per-namespace key isolation, but well below the urgency of a network-unauthenticated RCE. No data conflicts were found: the CVSS vector, the EUVD affected range (0.2.0 to <0.9.0), and the description all agree.

In a multi-tenant deployment where one temporal-proxy instance holds keys for several namespaces with payload encryption enabled, an operator authorized only for namespace B obtains an encrypted payload originating from namespace A (for example from backups, logs, or shared storage). On 0.8.0 they POST that ciphertext to the codec server's /decode endpoint; on any affected version they write it into a namespace B workflow they control and read it back through the proxy, and the proxy decrypts it because it selects the key by an identifier inside the payload rather than by the requesting namespace. No public exploit code or KEV listing is identified at time of analysis.