Vulnerability · Published Dec 30, 2025 · Assigned by Temporal
CVE-2025-14986ExecuteMultiOperation Namespace Policy Bypass
Low 1.3
In plain English
A low-severity incorrect authorization in Temporal from Temporal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | go.temporal.io/server | 1.27.4 | GHSA-p2gr-hm8g-q772 |
| Go | go.temporal.io/server | 1.28.2 | GHSA-p2gr-hm8g-q772 |
| Go | go.temporal.io/server | 1.29.2 | GHSA-p2gr-hm8g-q772 |
| Go | go.temporal.io/server | 1.27.4, 1.28.2, 1.29.2 | GO-2025-4272 |
Affected products (as reported)
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/RE:L/U:Green