Namespace Privilege Escalation in Temporal Server by Temporal Technologies

CVE-2026-5199

What is CVE-2026-5199?

A vulnerability in Temporal Server enables a user with writer role access in an attacker-controlled namespace to manipulate workflows or activities within a victim's namespace. This is achieved by exploiting a bug in version 1.29.0 that permitted the attacker to control the namespace name value erroneously. The flaw arises because the batch activity code validated the namespace ID but failed to verify the namespace name against the worker's bound namespace. As a result, the worker's privileged credentials can be leveraged to operate on arbitrary namespaces. The vulnerability is particularly concerning in configurations where internal components have cross-namespace authorizations, such as in deployments of the internal-frontend service.

References