S2S Proxy
Monthly
Unauthenticated remote attackers can bypass client-certificate trust in Temporal's s2s-proxy 0.1.16 through 0.2.2 by presenting a self-signed certificate and key to a mux or TCP TLS server listener, because the proxy runs Go's RequireAnyClientCert mode whenever skipCAVerification is false and therefore never validates the presented chain against the configured CA. A successful handshake yields a yamux-multiplexed, peer-authenticated channel on which the attacker can call every RPC the proxy's aclPolicy allows, exercising the proxy's own Temporal credentials against the cross-cluster replication API without supplying any trusted certificate, private key, or Temporal credential. No CISA KEV active-exploitation signal is present and no public exploit identified at time of analysis, but the defect carries a 9.3 CVSS 4.0 score and the vendor has published an upstream fix (PR #296 plus associated commits).
Unauthenticated remote attackers can bypass client-certificate trust in Temporal's s2s-proxy 0.1.16 through 0.2.2 by presenting a self-signed certificate and key to a mux or TCP TLS server listener, because the proxy runs Go's RequireAnyClientCert mode whenever skipCAVerification is false and therefore never validates the presented chain against the configured CA. A successful handshake yields a yamux-multiplexed, peer-authenticated channel on which the attacker can call every RPC the proxy's aclPolicy allows, exercising the proxy's own Temporal credentials against the cross-cluster replication API without supplying any trusted certificate, private key, or Temporal credential. No CISA KEV active-exploitation signal is present and no public exploit identified at time of analysis, but the defect carries a 9.3 CVSS 4.0 score and the vendor has published an upstream fix (PR #296 plus associated commits).