47 matches found
CVE-2026-89140
Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callback...
CVE-2026-104355 Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces
A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...
Reliance on Untrusted Inputs in a Security Decision
Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the Nexus callback routing logic in chasm/lib/callback/request.go and components/callbacks/request.go. An attacker can make the History service send a state-changing internal...
Reliance on Untrusted Inputs in a Security Decision
Overview Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the Nexus callback routing logic in chasm/lib/callback/request.go and components/callbacks/request.go. An attacker can make the History service send a state-changing internal...
CVE-2026-87858 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...
CVE-2026-87858
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...
CVE-2026-87858: Reliance on Untrusted Inputs in a Security Decision
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...
PT-2026-96078
Name of the Vulnerable Software and Affected Versions Temporal Server versions 1.25.0 through 1.30.x Description An authenticated user with write permissions in a single namespace can trigger unauthorized administrative actions by exploiting how the server identifies internal Workflow completion...
CVE-2026-72947
Integer underflow wrap or wraparound in Windows File History Service allows an authorized attacker to elevate privileges locally...
CVE-2026-71340
Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally...
CVE-2026-68837
Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally...
EUVD-2026-73343
Integer underflow wrap or wraparound in Windows File History Service allows an authorized attacker to elevate privileges locally...
Windows File History Service Elevation of Privilege Vulnerability
Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally...
Windows File History Service Elevation of Privilege Vulnerability
Integer underflow wrap or wraparound in Windows File History Service allows an authorized attacker to elevate privileges locally...
CVE-2026-68837: Use After Free
Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally...
PT-2026-87832
Name of the Vulnerable Software and Affected Versions Windows File History Service affected versions not specified Description A use after free issue in the Windows File History Service allows an authorized attacker to elevate privileges locally. Use after free is a memory corruption flaw that...
CVE-2026-71340: Use After Free
Use after free in Windows File History Service allows an authorized attacker to elevate privileges locally...
PT-2026-87864
Name of the Vulnerable Software and Affected Versions Windows File History Service affected versions not specified Description An integer underflow wrap or wraparound occurs in the Windows File History Service. This issue allows an authorized attacker to elevate privileges locally, potentially...
CVE-2026-72947: Integer Underflow (Wrap or Wraparound)
Integer underflow wrap or wraparound in Windows File History Service allows an authorized attacker to elevate privileges locally...