CVE-2026-87858 Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

CVE-2026-65651

temporalio/sqlparser accepts SQL with deeply nested unary expressions and returns a correspondingly deep abstract syntax tree without enforcing a nesting limit . The library's String and Walk operations traverse that tree recursively, causing a runtime-fatal Go stack overflow that terminates the ...

CVE-2026-65651 temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal

temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree without enforcing an applicable nesting limit. The library's String and Walk operations recursively traverse that tree. An application that parses...

EUVD-2026-83891

temporalio/sqlparser can panic when Parse, ParseStrictDDL, or ParseNext processes a MySQL version comment whose contents are empty or consist only of one to five decimal digits. ExtractMysqlComment does not check the -1 result returned by strings.IndexFunc before using it as a slice boundary. The...

CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

EUVD-2026-83884

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

CVE-2026-16652

Temporal Server is vulnerable to excessive CPU consumption in its Schedule component. An authenticated caller with namespace write permission can create or update a Schedule that combines a fine-grained cadence with an exclusion calendar rejecting every candidate time, causing the server to evalu...

CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

CVE-2026-16652 Temporal Server Schedule exclusion search can cause excessive CPU consumption

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

PT-2026-96078

Name of the Vulnerable Software and Affected Versions Temporal Server versions 1.25.0 through 1.30.x Description An authenticated user with write permissions in a single namespace can trigger unauthorized administrative actions by exploiting how the server identifies internal Workflow completion...

PT-2026-96073

Name of the Vulnerable Software and Affected Versions Temporal Server affected versions not specified Description An authenticated user with namespace write permissions can cause a denial of service by creating or updating a Schedule that uses a fine-grained cadence combined with an exclusion...

CVE-2026-89139: Improper Neutralization of Special Elements used in an OS Command

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...

CVE-2026-87858: Reliance on Untrusted Inputs in a Security Decision

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist,...

PT-2026-96074

Name of the Vulnerable Software and Affected Versions temporalio/sqlparser affected versions not specified Temporal Server affected versions not specified Description The temporalio/sqlparser library allows SQL containing deeply nested unary expressions, resulting in a deep abstract syntax tree...

PT-2026-96079

Name of the Vulnerable Software and Affected Versions Temporal Server versions 1.31.0 through 1.31.2 Description The Worker Service in Temporal Server includes a Worker Controller Instance module that registers a compute provider named subprocess. This provider allows the execution of commands on...

PT-2026-96072

Name of the Vulnerable Software and Affected Versions temporalio/sqlparser affected versions not specified Temporal Server affected versions not specified Description A panic occurs when the Parse, ParseStrictDDL, or ParseNext functions process a MySQL version comment that is empty or contains on...

CVE-2026-16652: Unchecked Input for Loop Condition

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing...

CLEANSTART-2026-VL17238 Security fix for CVE-2026-33815 applied in: argo-workflows 4.0.4-r1, cloudnative-pg 1.26.3-r1, cloudnative-pg-fips 1.25.4-r4, cloudnative-pg-fips 1.27.3-r3, cloudnative-pg-fips 1.28.1-r3, jitsucom-bulker 2.10.0-r2, jitsucom-bulker 2.11.0-r1, jitsucom-bulker 2.8.6-r0, jitsucom-bulker 2.9.0-r0, keda 2.19.0-r3, keda-fips 2.18.3-r3, kube-bench 0.15.0-r0, openbao-fips 2.3.2-r6, openbao-fips 2.4.4-r6, step 0.29.0-r0, step 0.30.2-r1, step-cli 0.27.5-r1, step-issuer 0.10.2-r1, step-issuer 0.9.11-r1, temporal 1.5.1-r0, temporal-server 1.29.6-r0, temporal-server 1.30.4-r0, temporal-server 1.31.0.153.3-r0, temporal-server-fips 1.29.6-r0, temporal-server-fips 1.31.0.153.1-r0

CVE-2026-33815 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FB77791 Security fix for CVE-2026-40890 applied in: gotenberg 8.30.1-r0, kube-metrics-adapter 0.2.9-r0, temporal 1.5.1-r0, temporal-ui-server-fips 2.48.2-r0

CVE-2026-40890 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LH40285 Security fix for CVE-2026-5199 applied in: temporal 1.5.1-r0, temporal-server 1.28.4-r2, temporal-server 1.29.7-r2, temporal-server 1.30.5-r1, temporal-server 1.30.6-r1, temporal-server 1.31.1-r5

CVE-2026-5199 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...