Namespace Binding Issue in temporal-proxy by Temporal.io

CVE-2026-108126

What is CVE-2026-108126?

The temporal-proxy versions ranging from 0.2.0 to 0.8.0 expose a serious namespace binding vulnerability that compromises encrypted payload security. When encryption is enabled, the proxy selects the decryption key based on an identifier within the payload, rather than appropriately considering the namespace of the request. This design flaw allows an authorized caller of one namespace to decrypt data from another namespace if they possess an encrypted payload from that namespace. Particularly in version 0.8.0, this issue is exacerbated as the payload can be submitted to the codec server’s /decode endpoint. An attacker with write access to one namespace can read encrypted payloads belonging to another namespace through the proxy, regardless of whether they share the same encryption key or have separate ones. The vulnerability does not facilitate the modification of encrypted payloads but enables the unauthorized retrieval of existing data.

References