Companies/Temporal Cloud/CVEs

TTemporal Cloud CVEs

19 vulnerabilities mapped to Temporal Cloud’s software or packages, 0 of them in CISA’s Known Exploited Vulnerabilities catalog, newest first. Not a statement that the hosted service was exposed.

CVEs mapped to a company Rewindex tracks (by CVE affected-product data, NVD CPE, vendor advisories and package feeds), every entry in CISA’s Known Exploited Vulnerabilities catalog, and CVEs named in a tracked status incident. Other CVEs are not listed. Same list on the all-vendor CVE index.

• 2026-10-15

  CVE-2026-108126 temporal-proxy payload decryption is not bound to the request namespace

  CVSS 6.0 mediumEPSS 0.36%

• 2026-10-12

  CVE-2026-89140 Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state

  CVSS 6.0 mediumEPSS 0.33%

• 2026-10-12

  CVE-2026-104355 Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces

  CVSS 7.0 highEPSS 0.36%

• 2026-09-23

  CVE-2026-96770 s2s-proxy accepts untrusted client certificates

  CVSS 9.3 criticalEPSS 0.32%

• 2026-09-21

  CVE-2026-89139 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host

  CVSS 8.7 highEPSS 0.58%

• 2026-09-21

  CVE-2026-87858 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

  CVSS 7.2 highEPSS 0.78%

• 2026-09-21

  CVE-2026-65654 temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossip

  CVSS 8.7 highEPSS 0.58%

• 2026-09-21

  CVE-2026-65653 temporalio/tchannel-go zero-chunk call fragment causes process termination

  CVSS 8.7 highEPSS 0.71%

• 2026-09-21

  CVE-2026-65652 temporalio/tchannel-go malformed checksum type causes process termination

  CVSS 8.7 highEPSS 0.71%

• 2026-09-21

  CVE-2026-65651 temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal

  CVSS 8.7 highEPSS 0.67%

• 2026-09-21

  CVE-2026-16651 temporalio/sqlparser malformed MySQL version comments can cause a panic

  CVSS 8.7 highEPSS 0.53%

• 2026-09-21

  CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption

  CVSS 7.1 highEPSS 0.47%

• 2026-08-11

  CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

  CVSS 2.3 lowEPSS 0.37%

• 2026-04-10

  CVE-2026-5724 Missing Authentication on Streaming gRPC Replication Endpoint

  CVSS 6.3 mediumEPSS 0.53%

• 2026-04-01

  CVE-2026-5199 Cross Namespace Access via Batch Operation

  CVSS 2.3 lowEPSS 0.32%

• 2025-12-30

  CVE-2025-14986 ExecuteMultiOperation Namespace Policy Bypass

  CVSS 1.3 lowEPSS 0.43%

• 2025-12-30

  CVE-2025-14987 Cross Namespace Commands Authorization Bypass

  CVSS 5.3 mediumEPSS 0.40%

• 2025-09-15

  CVE-2025-8396

  CVSS 6.9 mediumEPSS 0.39%

• 2025-02-12

  CVE-2025-1243 Field in api-go proxy not transformed before version 1.44.1

  CVSS 2.0 lowEPSS 0.09%

All vendors’ CVEs · JSON · Markdown

• CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
• This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
• Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
• EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)