Unauthorized Access in Temporal gRPC Server Stream for Workflow Service by Temporal

CVE-2026-5724

What is CVE-2026-5724?

The gRPC server of Temporal improperly implements authorization in its streaming interceptor chain. Specifically, the absence of an authorization interceptor means that the AdminService/StreamWorkflowReplicationMessages endpoint permits requests without credentials. This poses significant security risks as it allows attackers with network access to breach the replication stream. While unary RPCs enforce authentication and authorization effectively, the streaming endpoint on the same port as the WorkflowService does not, making it vulnerable to potential data exfiltration. An attacker must know the specific cluster configuration to exploit this vulnerability effectively.

References