Skip to content
OpenAdvisories

Package · Go

go.temporal.io/server

7 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-5724 Public exploit

    Missing Authentication on Streaming gRPC Replication Endpoint

    The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicati…

    Temporal Technologies temporal go.temporal.io/server Go
  • Medium 5.3
    CVE-2025-14987

    Cross Namespace Commands Authorization Bypass

    When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different n…

    Temporal Temporal go.temporal.io/server Go
  • Medium 6.9
    CVE-2025-8396

    Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling

    Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms due to excessive memory allocation.This issue affects all platforms and versions of OSS Server prior to 1.26.3, 1.27.3, and…

    Temporal OSS Server go.temporal.io/server Go
  • Medium 4.4
    CVE-2024-2689

    Denial of Service if invalid UTF-8 sent

    Denial of Service in Temporal Server prior to version 1.20.5, 1.21.6, and 1.22.7 allows an authenticated user who has permissions to interact with workflows and has crafted an invalid UTF-8 string for submission to potentially cause a crashloop. If left unche…

    Temporal Technologies Temporal Server go.temporal.io/server github.com/temporalio/temporal Go