Temporal Technologies, Inc. Temporal Server
10 CVEs affecting Temporal Technologies, Inc. Temporal Server. Latest disclosed: 2026-11-02. Critical: 0, High: 0.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-2689 | Medium | 4.4 | 2024-04-03 | Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows an… |
CVE-2023-3485 | Low | 3.0 | 2023-06-30 | Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other… |
CVE-2026-120091 | | 2026-11-02 | Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute… | |
CVE-2026-89140 | | 2026-10-12 | Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in… | |
CVE-2026-104355 | | 2026-10-12 | A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applie… | |
CVE-2026-89139 | | 2026-09-21 | Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose funct… | |
CVE-2026-87858 | | 2026-09-21 | Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only writ… | |
CVE-2026-65651 | | 2026-09-21 | temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an app… | |
CVE-2026-16652 | | 2026-09-21 | Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission cou… | |
CVE-2026-16651 | | 2026-09-21 | temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to fi… |