PT-2023-25032 · Unknown · Temporal Server
Jacob Legrone
·
Published
2023-06-30
·
Updated
2025-09-16
·
CVE-2023-3485
CVSS v3.1
3.0
Low
| Vector | AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Temporal Server versions prior to 1.20
Description
Insecure defaults in the open-source Temporal Server allow an attacker to craft a task token with access to a namespace other than the one specified in the request. This can be done outside of the normal Temporal server flow, requiring the namespace UUID and information from the workflow history for the target namespace. Under these conditions, it is possible to interfere with pending tasks in other namespaces, such as marking a task failed or completed. If a task is targeted for completion by the attacker, the targeted namespace must also be using the same data converter configuration as the initial, valid, namespace for the task completion payload to be decoded by workers in the target namespace.
Recommendations
For Temporal Server versions prior to 1.20, update to version 1.20 or later to resolve the issue. As a temporary workaround, consider restricting access to the namespace UUID and workflow history information to minimize the risk of exploitation. Additionally, ensure that all namespaces use unique data converter configurations to prevent attackers from decoding task completion payloads in other namespaces.
Fix
Incorrect Authorization
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Temporal Server