Vulnerability in Temporal Server's Kubernetes Compute Provider
CVE-2026-120091

8.7HIGH

Key Information:

Vendor

Temporal Technologies, Inc.

Status
Temporal Server
Vendor
CVE Published:
2 November 2026

What is CVE-2026-120091?

The Temporal Server's Worker Controller Instance module allows for improper access control through its Kubernetes compute provider. Specifically, it builds a Kubernetes client using configurations from an authenticated request rather than predefined operator settings. This misconfiguration enables unauthorized command execution on the Worker Service host under the server process's account. Notably, operations such as 'CreateWorkerDeploymentVersion' require a write role, while 'ValidateWorkerDeploymentVersionComputeConfig' can be accessed with minimal permissions, potentially exposing the entire Kubernetes cluster. This issue affects versions 1.31.0 through 1.31.2, where the default allowlist does not restrict the k8s compute provider, posing significant security risks without proper authorization settings.

Affected Version(s)

Temporal Server 1.31.0 < 1.31.5

Temporal Server 1.32.0 < 1.32.2

References

https://github.com/temporalio/temporal/releases/tag/v1.32.2
release-notes
https://github.com/temporalio/temporal/releases/tag/v1.31.5
release-notes
https://github.com/temporalio/temporal-auto-scaled-worker...
patch

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

An external security researcher who reported this issue responsibly to Temporal Technologies
.