Temporal Technologies Inc. Temporal Server

• CVE-2026-120091 High 8.7 Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host 0.5%
• CVE-2026-89140 Medium 6.0 Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state 0.3%
• CVE-2026-104355 High 7.0 Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces 0.4%
• CVE-2026-89139 High 8.7 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host 0.6%
• CVE-2026-87858 High 7.2 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization 0.8%
• CVE-2026-65651 High 8.7 temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal 0.7%
• CVE-2026-16651 High 8.7 temporalio/sqlparser malformed MySQL version comments can cause a panic 0.5%
• CVE-2026-16652 High 7.1 Temporal Server Schedule exclusion search can cause excessive CPU consumption 0.5%
• CVE-2024-2689 Medium 4.4 Denial of Service if invalid UTF-8 sent 0.5%
• CVE-2023-3485 Low 3.0 Insecure Default Authorization in Temporal Server 0.2%