PT-2026-29583 · Temporal · Temporal Server

Published

2026-04-01

·

Updated

2026-04-02

·

CVE-2026-5199

CVSS v4.0

2.3

Low

VectorAV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:X/RE:M/U:X
Name of the Vulnerable Software and Affected Versions Temporal Server versions 1.29.0 and later
Description A user with a writer role in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster. Exploitation requires the attacker to know or guess specific victim workflow ID(s) and, for signal operations, signal names. This issue stemmed from a bug introduced in Temporal Server v1.29.0, where the server incorrectly allowed an attacker to control the namespace name value instead of using a trusted value within the batch activity code. The batch activity validated the namespace ID but did not verify the namespace name against the worker's bound namespace, enabling privileged credentials to operate on an arbitrary namespace. Exploitation requires a server configuration with cross-namespace authorization, such as the deployment of the internal-frontend service or equivalent TLS-based authorization for internal identities. This vulnerability also impacted Temporal Cloud when the attacker and victim namespaces were on the same cell.
Recommendations Update Temporal Server to a version later than 1.29.0.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-5199
GHSA-XPG8-3HHP-P7W8

Affected Products

Temporal Server