Temporal Server vulnerabilities
7 known vulnerabilities in Temporal Server from Temporal Technologies. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.7 High severity
Temporal Server: Improper Neutralization of Special Elements used in an OS Command
Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provi
- 7.0 High severity
Temporal Server: Incorrect Authorization
A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls re
- 8.7 High severity
Temporal Server: Improper Neutralization of Special Elements used in an OS Command
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program
- 7.2 High severity
Temporal Server: Reliance on Untrusted Inputs in a Security Decision
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the conf
- 8.7 High severity
temporalio/sqlparser: Uncontrolled Recursion
temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An ap
- 7.1 High severity
Temporal Server: Unchecked Input for Loop Condition
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that r
- 8.7 High severity
temporalio/sqlparser: Improper Validation of Array Index
temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc bef