Temporal Technologies Inc.

Products

Exploited and recent CVEs

• CVE-2026-120091 High 8.7 Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host 0.5%
• CVE-2026-108126 Medium 6.0 temporal-proxy payload decryption is not bound to the request namespace 0.4%
• CVE-2026-89140 Medium 6.0 Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state 0.3%
• CVE-2026-104355 High 7.0 Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces 0.4%
• CVE-2026-96770 Critical 9.3 s2s-proxy accepts untrusted client certificates 0.3%
• CVE-2026-89139 High 8.7 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host 0.6%
• CVE-2026-87858 High 7.2 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization 0.8%
• CVE-2026-65654 High 8.7 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip 0.6%
• CVE-2026-65653 High 8.7 temporalio/tchannel-go zero-chunk call fragment causes process termination 0.7%
• CVE-2026-65652 High 8.7 temporalio/tchannel-go malformed checksum type causes process termination 0.7%
• CVE-2026-65651 High 8.7 temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal 0.7%
• CVE-2026-65651 High 8.7 temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal 0.7%
• CVE-2026-16651 High 8.7 temporalio/sqlparser malformed MySQL version comments can cause a panic 0.5%
• CVE-2026-16651 High 8.7 temporalio/sqlparser malformed MySQL version comments can cause a panic 0.5%
• CVE-2026-16652 High 7.1 Temporal Server Schedule exclusion search can cause excessive CPU consumption 0.5%
• CVE-2026-65655 Low 2.3 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy 0.4%
• CVE-2026-5724 Medium 6.3 Missing Authentication on Streaming gRPC Replication Endpoint 0.5%
• CVE-2026-5199 Low 2.3 Cross Namespace Access via Batch Operation 0.3%
• CVE-2025-1243 Low 2.0 Field in api-go proxy not transformed before version 1.44.1 <0.1%
• CVE-2024-2689 Medium 4.4 Denial of Service if invalid UTF-8 sent 0.5%
• CVE-2023-3485 Low 3.0 Insecure Default Authorization in Temporal Server 0.2%