Jacob Legrone

**Name of the Vulnerable Software and Affected Versions** Temporal Server versions prior to 1.20 **Description** Insecure defaults in the open-source Temporal Server allow an attacker to craft a task token with access to a namespace other than the one specified in the request. This can be done outside of the normal Temporal server flow, requiring the namespace UUID and information from the workflow history for the target namespace. Under these conditions, it is possible to interfere with pending tasks in other namespaces, such as marking a task failed or completed. If a task is targeted for completion by the attacker, the targeted namespace must also be using the same data converter configuration as the initial, valid, namespace for the task completion payload to be decoded by workers in the target namespace. **Recommendations** For Temporal Server versions prior to 1.20, update to version 1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the namespace UUID and workflow history information to minimize the risk of exploitation. Additionally, ensure that all namespaces use unique data converter configurations to prevent attackers from decoding task completion payloads in other namespaces.