CVE-2026-104355

A flaw was found in Temporal Server. In a multi-cluster deployment, the server fails to verify whether inbound replication tasks apply only to global namespaces. An attacker controlling a connected peer cluster can exploit this vulnerability by sending replication updates that overwrite...

CLEANSTART-2026-MC29038 Security fix for GHSA-hrxh-6v49-42gf applied in: temporal-server 1.30.8-r1, grafana-fips 13.1.0-r1, temporal-server-fips 1.31.4-r1, istio-pilot-discovery 1.29.8-r1, istio-pilot-discovery 1.30.1-r1, openbao 2.6.1-r0, external-dns 0.20.0-r3, kube-state-metrics 2.20.0-r4

GHSA-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YS81054 Security fix for GHSA-259r-337f-4rfw applied in: temporal-server 1.30.8-r2, temporal-server-fips 1.31.4-r2, argo-rollouts 1.10.0-r1, stakater-reloader 1.2.1-r5, istio-pilot-discovery 1.29.8-r1, istio-pilot-discovery 1.30.1-r1, stakater-reloader 1.1.0-r9, stakater-reloader 1.3.0-r9, openbao 2.6.1-r0, nfs-subdir-external-provisioner 4.0.18-r4, mongodb 8.2.12-r4

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-JO59032 Echo is a Go web framework

Security vulnerability affects the temporal-server-fips package. Echo is a Go web framework...

CLEANSTART-2026-UX94602 When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint

Security vulnerability affects the temporal-server-fips package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint...

CLEANSTART-2026-IO14579 When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will...

Security vulnerability affects the temporal-server-fips package. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only...

CLEANSTART-2026-DE80520 writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster

Security vulnerability affects the temporal-server-fips package. A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster...

CLEANSTART-2026-SU88556 filippo

Security vulnerability affects the temporal-server-fips package. filippo...

CLEANSTART-2026-AW40978 frontend gRPC server's streaming interceptor chain did not include the authorization interceptor

Security vulnerability affects the temporal-server-fips package. The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor...

CLEANSTART-2026-MC70184 Memory-safety vulnerability in github

Security vulnerability affects the temporal-server-fips package. Memory-safety vulnerability in github...

CLEANSTART-2026-JS92674 Memory-safety vulnerability in github

Security vulnerability affects the temporal-server-fips package. Memory-safety vulnerability in github...

PT-2026-122839

Security vulnerability affects the temporal-server-fips package. When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint...

PT-2026-122693

Security vulnerability affects the temporal-server-fips package. The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor...

CVE-2026-89140

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callback...

CVE-2026-104355

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

EUVD-2026-97769

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callback...

CVE-2026-89140 Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callback...

CVE-2026-89140 Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callback...

CVE-2026-89140

The Temporal Server contains a vulnerability where internal completion callbacks are not bound to their specific namespaces. This allows an authenticated caller with write permissions in one namespace to manipulate the Scheduler V2 schedule state in a different namespace. The flaw exists because ...

CVE-2026-104355

A Temporal Server cluster is vulnerable to unauthorized modification of its local namespaces (including the built-in temporal-system namespace) when connected to a registered peer cluster. The root cause is an incorrect authorization logic where the receiving cluster fails to verify if a namespac...