PT-2026-6501 · Go · Go.Temporal.Io/Server

Published 2026-01-12 · Updated 2026-01-12

OSV

Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts in go.temporal.io/server

Related Identifiers

GO-2025-4272

Affected Products

Go.Temporal.Io/Server

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-14986 · Security Note
• https://osv.dev/vulnerability/GO-2025-4272 · Vendor Advisory
• https://github.com/temporalio/temporal/releases/tag/v1.27.4 · Note
• https://github.com/temporalio/temporal/releases/tag/v1.29.2 · Note
• https://github.com/temporalio/temporal/releases/tag/v1.28.2 · Note
• https://github.com/temporalio/temporal/pull/8839 · Note
• https://github.com/advisories/GHSA-p2gr-hm8g-q772 · Note