Temporal Server
Monthly
Authenticated callers holding only a write role in a single namespace can execute arbitrary commands on the host running Temporal Server's Worker Service, because the built-in `subprocess` compute provider derives the program name and argument vector from caller-supplied compute provider configuration instead of operator configuration, and the configuration handler invokes it immediately after spec validation with no scaling decision or task arrival required. Deployments are affected when running Temporal Server 1.31.0 through 1.31.2 with the Worker Service active and the per-namespace dynamic config `workercontroller.compute_providers.enabled` either unset (the default, in which case the allowlist check is skipped entirely) or explicitly containing `subprocess`; authentication with a namespace write role is required (CVSS vector PR:L), and a deployment with no authorizer is already fully open rather than being a special case of this flaw. Since the Worker Service process holds persistence credentials for every namespace in the cluster plus the cluster TLS material, successful exploitation reaches beyond the caller's namespace to the cluster as a whole, making this a genuine high-priority issue rather than CVSS inflation. Vendor patches are available in releases 1.31.3 and 1.32.0, and no public exploit was identified at time of analysis.
Temporal Server releases 1.30.0 and later let an authenticated caller holding write permission in only one namespace trick the server into issuing attacker-chosen, state-changing HTTP POSTs against its own administrative frontend API, enabling cross-namespace workflow termination, namespace registration, configuration tampering, and full namespace deletion. The caller exploits confused-deputy logic (CWE-807) by attaching a Workflow completion callback whose URL passes the configured address allowlist and whose header map contains a non-empty 'source' header, which the History service interprets as evidence the callback is internal; no network access to the internal frontend is required because the server makes the request itself. Releases 1.25.0 through 1.29.7 carry the same defect but require the 'source' header to exactly match a configured cluster-ID UUID that a namespace-scoped caller cannot read through the API, making exploitation materially harder; no public exploit code was identified at time of analysis, and exploitation is gated on non-default deployment settings. Vendor-released patches exist in 1.30.7, 1.31.3, and 1.32.0.
Denial of service in Temporal Server stems from uncontrolled recursion (CWE-674) in the bundled temporalio/sqlparser library: SQL containing deeply nested unary expressions is accepted and produces a correspondingly deep abstract syntax tree, and the library's recursive String and Walk traversals then exhaust the Go stack and abort the process in a way that Go panic recovery cannot contain. Affected are Temporal Server deployments prior to v1.30.7 and v1.31.3 that pass caller-controlled query text to the parser through the archival, visibility, and worker-query paths, including validation code that recursively formats an invalid expression while constructing an error. Exploitation requires an authenticated caller holding namespace read permission (the published CVSS 4.0 vector lists PR:N, but the reported prerequisites specify an authenticated caller and the independent assessment scores PR:L), the dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat, and repeated requests can sustain the outage; impact is availability-only and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash the receiving Matching process by submitting a malformed MySQL version comment through the ListWorkers API when that API is enabled. The root cause is in the bundled temporalio/sqlparser Go library, where ExtractMysqlComment fails to validate the -1 returned by strings.IndexFunc before using it as a slice boundary, producing an unhandled Go runtime panic whenever a '/*! ... */' comment has empty contents or one to five decimal digits. Impact is availability-only (process termination, repeatable to sustain an outage) with no confidentiality or integrity effect; no public exploit identified at time of analysis, and exploitation is gated on both API enablement and authenticated namespace read access.
CPU exhaustion in Temporal Server before v1.30.7 and v1.31.3 allows an authenticated caller holding namespace write permission (PR:L) to persist a Schedule whose fine-grained cadence is fully negated by an exclusion calendar, forcing the next-action-time search to evaluate excluded candidates without any per-search work budget and burning CPU in the Frontend and Schedule worker components. Because the abusive specification is stored, consumption continues through repeated backing-Workflow failures and retries even after the initial request finishes, until the Schedule is deleted or its backing Workflow terminated; repeated or parallel Schedules can degrade or deny service to shared infrastructure. The impact is availability-only with no exposure or modification of Workflow data, no public exploit code has been identified at time of analysis, and vendor-released patches are available in v1.30.7 and v1.31.3. This is a genuine but bounded availability issue whose severity is highest in multi-tenant clusters where one namespace's write access can degrade shared Frontend and Schedule-worker capacity.
Authenticated callers holding only a write role in a single namespace can execute arbitrary commands on the host running Temporal Server's Worker Service, because the built-in `subprocess` compute provider derives the program name and argument vector from caller-supplied compute provider configuration instead of operator configuration, and the configuration handler invokes it immediately after spec validation with no scaling decision or task arrival required. Deployments are affected when running Temporal Server 1.31.0 through 1.31.2 with the Worker Service active and the per-namespace dynamic config `workercontroller.compute_providers.enabled` either unset (the default, in which case the allowlist check is skipped entirely) or explicitly containing `subprocess`; authentication with a namespace write role is required (CVSS vector PR:L), and a deployment with no authorizer is already fully open rather than being a special case of this flaw. Since the Worker Service process holds persistence credentials for every namespace in the cluster plus the cluster TLS material, successful exploitation reaches beyond the caller's namespace to the cluster as a whole, making this a genuine high-priority issue rather than CVSS inflation. Vendor patches are available in releases 1.31.3 and 1.32.0, and no public exploit was identified at time of analysis.
Temporal Server releases 1.30.0 and later let an authenticated caller holding write permission in only one namespace trick the server into issuing attacker-chosen, state-changing HTTP POSTs against its own administrative frontend API, enabling cross-namespace workflow termination, namespace registration, configuration tampering, and full namespace deletion. The caller exploits confused-deputy logic (CWE-807) by attaching a Workflow completion callback whose URL passes the configured address allowlist and whose header map contains a non-empty 'source' header, which the History service interprets as evidence the callback is internal; no network access to the internal frontend is required because the server makes the request itself. Releases 1.25.0 through 1.29.7 carry the same defect but require the 'source' header to exactly match a configured cluster-ID UUID that a namespace-scoped caller cannot read through the API, making exploitation materially harder; no public exploit code was identified at time of analysis, and exploitation is gated on non-default deployment settings. Vendor-released patches exist in 1.30.7, 1.31.3, and 1.32.0.
Denial of service in Temporal Server stems from uncontrolled recursion (CWE-674) in the bundled temporalio/sqlparser library: SQL containing deeply nested unary expressions is accepted and produces a correspondingly deep abstract syntax tree, and the library's recursive String and Walk traversals then exhaust the Go stack and abort the process in a way that Go panic recovery cannot contain. Affected are Temporal Server deployments prior to v1.30.7 and v1.31.3 that pass caller-controlled query text to the parser through the archival, visibility, and worker-query paths, including validation code that recursively formats an invalid expression while constructing an error. Exploitation requires an authenticated caller holding namespace read permission (the published CVSS 4.0 vector lists PR:N, but the reported prerequisites specify an authenticated caller and the independent assessment scores PR:L), the dynamically confirmed ListWorkers route additionally requires at least one retained worker heartbeat, and repeated requests can sustain the outage; impact is availability-only and no public exploit code or confirmed active exploitation was identified at time of analysis.
Denial of service in Temporal Server allows an authenticated caller holding at least namespace read permission to crash the receiving Matching process by submitting a malformed MySQL version comment through the ListWorkers API when that API is enabled. The root cause is in the bundled temporalio/sqlparser Go library, where ExtractMysqlComment fails to validate the -1 returned by strings.IndexFunc before using it as a slice boundary, producing an unhandled Go runtime panic whenever a '/*! ... */' comment has empty contents or one to five decimal digits. Impact is availability-only (process termination, repeatable to sustain an outage) with no confidentiality or integrity effect; no public exploit identified at time of analysis, and exploitation is gated on both API enablement and authenticated namespace read access.
CPU exhaustion in Temporal Server before v1.30.7 and v1.31.3 allows an authenticated caller holding namespace write permission (PR:L) to persist a Schedule whose fine-grained cadence is fully negated by an exclusion calendar, forcing the next-action-time search to evaluate excluded candidates without any per-search work budget and burning CPU in the Frontend and Schedule worker components. Because the abusive specification is stored, consumption continues through repeated backing-Workflow failures and retries even after the initial request finishes, until the Schedule is deleted or its backing Workflow terminated; repeated or parallel Schedules can degrade or deny service to shared infrastructure. The impact is availability-only with no exposure or modification of Workflow data, no public exploit code has been identified at time of analysis, and vendor-released patches are available in v1.30.7 and v1.31.3. This is a genuine but bounded availability issue whose severity is highest in multi-tenant clusters where one namespace's write access can degrade shared Frontend and Schedule-worker capacity.