CVE-2026-89140 Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state

[
  {
    "vendor": "Temporal Technologies, Inc.",
    "product": "Temporal Server",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "go.temporal.io/server",
    "repo": "https://github.com/temporalio/temporal",
    "modules": [
      "Frontend",
      "History"
    ],
    "programFiles": [
      "service/frontend/workflow_handler.go",
      "components/callbacks/config.go",
      "components/callbacks/executors.go",
      "components/callbacks/chasm_invocation.go",
      "service/history/handler.go",
      "chasm/lib/scheduler/scheduler.go"
    ],
    "programRoutines": [
      {
        "name": "WorkflowHandler.validateWorkflowCompletionCallbacks"
      },
      {
        "name": "WorkflowHandler.validateCallbackURL"
      },
      {
        "name": "AddressMatchRules.Validate"
      },
      {
        "name": "chasmInvocation.Invoke"
      },
      {
        "name": "Handler.CompleteNexusOperationChasm"
      },
      {
        "name": "Scheduler.HandleNexusCompletion"
      }
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.30.0",
        "lessThan": "1.30.8",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
    ]
  },
  {
    "vendor": "Temporal Technologies, Inc.",
    "product": "Temporal Server",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "go.temporal.io/server",
    "repo": "https://github.com/temporalio/temporal",
    "modules": [
      "Frontend",
      "History"
    ],
    "programFiles": [
      "service/frontend/workflow_handler.go",
      "components/callbacks/config.go",
      "components/callbacks/executors.go",
      "components/callbacks/chasm_invocation.go",
      "chasm/lib/callback/invocable_internal.go",
      "service/history/handler.go",
      "chasm/lib/scheduler/scheduler.go"
    ],
    "programRoutines": [
      {
        "name": "WorkflowHandler.validateWorkflowCompletionCallbacks"
      },
      {
        "name": "WorkflowHandler.validateCallbackURL"
      },
      {
        "name": "AddressMatchRules.Validate"
      },
      {
        "name": "chasmInvocation.Invoke"
      },
      {
        "name": "invocableInternal.Invoke"
      },
      {
        "name": "Handler.CompleteNexusOperationChasm"
      },
      {
        "name": "Scheduler.HandleNexusCompletion"
      }
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.31.0",
        "lessThan": "1.31.4",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
    ]
  },
  {
    "vendor": "Temporal Technologies, Inc.",
    "product": "Temporal Server",
    "collectionURL": "https://pkg.go.dev",
    "packageName": "go.temporal.io/server",
    "repo": "https://github.com/temporalio/temporal",
    "modules": [
      "Frontend",
      "History"
    ],
    "programFiles": [
      "service/frontend/workflow_handler.go",
      "chasm/lib/callback/validator.go",
      "chasm/lib/callback/config.go",
      "components/callbacks/executors.go",
      "components/callbacks/chasm_invocation.go",
      "chasm/lib/callback/invocable_internal.go",
      "service/history/handler.go",
      "chasm/lib/scheduler/scheduler.go"
    ],
    "programRoutines": [
      {
        "name": "WorkflowHandler.prepareStartWorkflowRequest"
      },
      {
        "name": "validator.Validate"
      },
      {
        "name": "AddressMatchRules.Validate"
      },
      {
        "name": "chasmInvocation.Invoke"
      },
      {
        "name": "invocableInternal.Invoke"
      },
      {
        "name": "Handler.CompleteNexusOperationChasm"
      },
      {
        "name": "Scheduler.HandleNexusCompletion"
      }
    ],
    "versions": [
      {
        "status": "affected",
        "version": "1.32.0",
        "lessThan": "1.32.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected",
    "cpes": [
      "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
    ]
  }
]