Namespace Modification Vulnerability in Temporal Server by Temporal.io
CVE-2026-104355

7HIGH

Key Information:

Vendor

Temporal Technologies, Inc.

Status
Temporal Server
Vendor
CVE Published:
12 October 2026

What is CVE-2026-104355?

A vulnerability exists in the Temporal Server that allows a connected peer cluster to modify local namespaces. When replication tasks are pulled from remote clusters, the receiving server does not enforce the same exclusion rule for local namespaces as the sending side does. This can lead to unauthorized changes in namespace states, including marking namespaces as Deprecated, altering their retention settings, and even designating a peer as the active cluster. These changes can disrupt workflows and lead to failures, especially if an attacker gains control of a registered peer cluster.

Affected Version(s)

Temporal Server 1.0.0 <= 1.29.7

Temporal Server 1.30.0 < 1.30.8

Temporal Server 1.31.0 < 1.31.4

References

https://github.com/temporalio/temporal/blob/v1.0.0/common...
product
https://github.com/temporalio/temporal/pull/12323
patch
https://github.com/temporalio/temporal/commit/f2b571e2eee...
patch

CVSS V4

Score:
7
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zellic, who reported this issue responsibly to Temporal Technologies
V12
.