Description
When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace.
This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Temporal | Temporal | ≤ 1.29.1, ≤ 1.28.1, ≤ 1.27.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20260114T191543-150000.1.137.1 | SUSE-SU-2026:0142-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | go.temporal.io/server | < 1.27.4 | 1.27.4 | GHSA-hmhp-gh8m-c8xp |
| Go | go.temporal.io/server | >= 1.28.0, < 1.28.2 | 1.28.2 | GHSA-hmhp-gh8m-c8xp |
| Go | go.temporal.io/server | >= 1.29.0, < 1.29.2 | 1.29.2 | GHSA-hmhp-gh8m-c8xp |
| Go | go.temporal.io/server | >= 1.29.0-0, < 1.29.0-135.0.0.20251218190115-b292a32bacdf | 1.29.0-135.0.0.20251218190115-b292a32bacdf | GHSA-hmhp-gh8m-c8xp |
| Go | go.temporal.io/server | < 1.27.4 · >= 1.28.0, < 1.28.2 · >= 1.29.0, < 1.29.2 | 1.27.4, 1.28.2, 1.29.2 | GO-2026-4273 |
Advisories 2
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:0142-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 23, 2026