CVE-2026-108126

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

CVE-2026-108126

Versions 0.2.0 through 0.8.0 of temporal-proxy are vulnerable to an authorization bypass because encrypted payloads are not bound to specific namespaces. When encryption is enabled, the proxy selects decryption keys based on an identifier inside the payload rather than the request's namespace. Th...

CVE-2026-108126 temporal-proxy payload decryption is not bound to the request namespace

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

CVE-2026-108126 temporal-proxy payload decryption is not bound to the request namespace

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

EUVD-2026-102301

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

CVE-2026-108126 temporal-proxy payload decryption is not bound to the request namespace

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

CVE-2026-108126

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

CVE-2026-108126: Authorization Bypass Through User-Controlled Key

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

PT-2026-115213

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

temporal.io Temporal Proxy Authorization Issue Vulnerability

In the versions of Temporal Proxy 0.2.0 to 0.8.0, there is an authorization issue. This issue arises from the failure to bind the encrypted payload to the namespace it belongs to at the time of encryption. As a result, the proxy selects the decryption key based on the identifier stored in the...