Temporal s2s-proxy CVE-2026-96770

Requires an s2s-proxy instance running an affected version (0.1.16 through 0.2.2) whose TLS server listener is configured with skipCAVerification=false (i.e. RequireClientAuth expected), which paradoxically triggers Go's RequireAnyClientCert mode that omits CA chain verification. The attacker must have network reachability to that mux/TCP server listener. No trusted certificate, private key, or Temporal credential is required, and no user interaction is needed. The practical limiting factor is network exposure of the replication listener and the breadth of RPCs enabled in the proxy's aclPolicy allowedMethods/allowedNamespaces, which bounds what an authenticated-as-peer attacker can do.

This is a genuine high-priority defect, not a high-CVSS-but-low-risk artifact. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a network-reachable, low-complexity, fully unauthenticated flaw, and the description confirms the substance: because TLS server listeners select Go's RequireAnyClientCert mode when skipCAVerification is false, the proxy proves the client possesses a private key but never checks the certificate against the configured CA (CWE-296). An attacker's own self-signed cert therefore satisfies the check, so the intended mTLS trust boundary provides no authentication at all. The scope-change signals (SC:H/SI:H/SA:H) are well-founded: a successful connection lets the attacker invoke the admin-service RPCs permitted by the proxy's aclPolicy (e.g. AddOrUpdateRemoteCluster, GetWorkflowExecutionRawHistoryV2, StreamWorkflowReplicationMessages) against the backing Temporal cluster. No EPSS score, KEV entry, or SSVC decision data was provided, and no weaponized POC is referenced - but the CVE ships direct source-code evidence (encryption/tls.go and the fixing commit), the logic error is trivially understood, and no secret material is needed to exploit it, which collectively imply a low exploitation barrier for anyone who can reach an affected listener. The one material limiter is exposure: the proxy's mux/TCP server listener must be network-reachable to the attacker, which in typical cross-cluster replication deployments may be a restricted network path rather than the open internet.

An attacker who can reach an s2s-proxy TLS server listener (versions 0.1.16-0.2.2 with skipCAVerification=false) generates a throwaway self-signed certificate and key, which satisfies the RequireAnyClientCert private-key check without any CA validation. They complete the TLS and yamux handshake as if they were a trusted peer cluster and then issue the admin-service RPCs the proxy's ACL allows, reaching the backing Temporal cluster with no trusted certificate and no Temporal credential. No public weaponized exploit is referenced, but the vendor commit and vulnerable source lines are published, making reproduction straightforward.