Unauthorized Namespace Manipulation in Temporal Server by Temporal.io

CVE-2026-89140

What is CVE-2026-89140?

The vulnerability in Temporal Server arises from its failure to bind internal completion callbacks to the appropriate namespace, allowing authorized users to manipulate Scheduler V2 operations in different namespaces. Without proper authentication checks, an attacker could attach misleading callbacks to Workflow start requests, disrupting the intended Workflow execution. This can lead to unauthorized changes in schedule state and potentially bypass operational integrity checks, affecting workflow overlap policies and schedule behaviors. Critical to note, this vulnerability does not expose any Workflow payloads or historical data, but poses significant risks to namespace governance in affected releases.

References