Temporal Technologies vulnerabilities
We track 11 vulnerabilities in Temporal Technologies products across 5 products. 11 are rated high or critical, and none are known to be exploited. The most recent was published on November 2, 2026.
Latest Temporal Technologies vulnerabilities
- 8.7 High severity
Temporal Server: Improper Neutralization of Special Elements used in an OS Command
Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provi
- 7.0 High severity
Temporal Server: Incorrect Authorization
A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls re
- 9.3 Critical severity
s2s-proxy: Improper Following of a Certificate's Chain of Trust
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but do
- 8.7 High severity
Temporal Server: Improper Neutralization of Special Elements used in an OS Command
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program
- 7.2 High severity
Temporal Server: Reliance on Untrusted Inputs in a Security Decision
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the conf
- 8.7 High severity
temporalio/ringpop-go: Allocation of Resources Without Limits or Throttling
github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected versions do not apply those limits to label maps received in SWIM membership changes. A network peer that can reach a liv
- 8.7 High severity
temporalio/tchannel-go: Improper Validation of Array Index
github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks. The fragment reader left its chunk slice empty and then unconditionally selected the first element. A network peer can
- 8.7 High severity
temporalio/tchannel-go: Improper Validation of Array Index
github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can reach a listener can complete the standard initialization handshake and send a call request with an unsupported checksu
- 8.7 High severity
temporalio/sqlparser: Uncontrolled Recursion
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An ap
- 7.1 High severity
Temporal Server: Unchecked Input for Loop Condition
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that r
- 8.7 High severity
temporalio/sqlparser: Improper Validation of Array Index
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc bef