PT-2025-54225 · Temporal · Temporal

Published

2025-12-30

·

Updated

2026-01-17

·

CVE-2025-14987

CVSS v4.0

5.3

Medium

VectorAV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
Name of the Vulnerable Software and Affected Versions Temporal versions through 1.29.1
Description When the system.enableCrossNamespaceCommands setting is enabled, the Temporal server allows specific workflow task commands—including StartChildWorkflowExecution, SignalExternalWorkflowExecution, and RequestCancelExternalWorkflowExecution—to operate on a namespace different from the one authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without re-authorizing the caller for that target namespace. This can potentially allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace.
Recommendations Update to Temporal version 1.27.4 or later. Update to Temporal version 1.28.2 or later. Update to Temporal version 1.29.2 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2025-14987
GHSA-HMHP-GH8M-C8XP
GO-2026-4273
SUSE-SU-2026:0142-1

Affected Products

Temporal