CLEANSTART-2026-UG13000 Security fixes in temporal-ui-server-fips 2.51.1-r1

Package temporal-ui-server-fips version 2.51.1-r1 fixes 36 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655

Temporal UI Server may set OAuth credential cookies without Secure when TLS terminates at a reverse proxy and forwards callbacks to the UI server over HTTP. This can allow an attacker-controlled scenario to access access-token and possibly refresh-token cookies if the attacker can steer UI hostna...

EUVD-2026-56924

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

PT-2026-70889

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CLEANSTART-2026-BQ82502 Security fixes in temporal-ui-server-fips 2.44.0-r0

Package temporal-ui-server-fips version 2.44.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

CLEANSTART-2026-FO93349 Security fixes for CVE-2025-61732, CVE-2025-68121, CVE-2026-33186, CVE-2026-40890, ghsa-77fj-vx54-gvh7, ghsa-p77j-4mvh-x3m3 applied in versions: 2.44.0-r0, 2.48.2-r0

Multiple security vulnerabilities affect the temporal-ui-server-fips package. These issues are resolved in later releases. See references for individual vulnerability details...

GHSA-77FJ-VX54-GVH7 vulnerabilities

Vulnerabilities for packages: temporal, temporal-ui-server, kube-metrics-adapter, fq, snyk-cli...

CVE-2026-40890 vulnerabilities

Vulnerabilities for packages: temporal, temporal-ui-server, kube-metrics-adapter, fq, snyk-cli...

CVE-2026-40890 vulnerabilities

Vulnerabilities for packages: gotenberg, temporal, snyk-cli, kube-metrics-adapter-fips, kube-metrics-adapter, temporal-ui-server-fips, temporal-fips, fq, temporal-ui-server...

GHSA-77FJ-VX54-GVH7 vulnerabilities

Vulnerabilities for packages: gotenberg, temporal, snyk-cli, kube-metrics-adapter-fips, kube-metrics-adapter, temporal-ui-server-fips, temporal-fips, fq, temporal-ui-server...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: nri-nginx-fips, podman-fips, aws-load-balancer-controller, rancher-webhook-fips, cloudnative-pg-fips, witness, ytt, pgtimetable, telegraf, crossplane-provider-aws-ecs, nri-f5, kyverno, nuclei, backup-restore-operator-fips, cert-manager-csi-driver, commercial-grafana,...

GHSA-5W89-2C2X-6X66 vulnerabilities

Vulnerabilities for packages: pgtimetable, backup-restore-operator-fips, cert-manager-csi-driver, kube-state-metrics, pgpool2exporter, helm-exporter, prometheus-snmp-exporter, nfpm, json-exporter-fips, velero-plugin-for-microsoft-azure-fips, nats-top, plugin-barman-cloud-fips,...

PT-2024-20370

Name of the Vulnerable Software and Affected Versions Temporal UI Server affected versions not specified Description The issue allows an attacker with pre-existing access to send a signal to a workflow to execute a script when a victim views the signal. This is achieved by making the signal name ...