Vulnerability · Published Sep 21, 2026 · Assigned by Temporal

CVE-2026-16652Temporal Server Schedule exclusion search can cause excessive CPU consumption

High 7.1

In plain English

A high-severity security flaw in Temporal Server from Temporal Technologies, Inc.. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 4.0)7.1High

Exploit odds (30 days)0.5%top 59.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.

Affected products (as reported)

Vendor	Product	Versions
Temporal Technologies, Inc.	Temporal Server	1.17.0 – through 1.29.71.30.0 – before 1.30.71.31.0 – before 1.31.3

Weakness: CWE-606 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

In plain English

Official description

Affected products (as reported)

References