GO-2025-3462 vulnerabilities

Vulnerabilities for packages: temporal-server, temporal-ui-server, temporal-ui-server-fips, temporal-server-fips, temporal, temporal-fips...

GO-2026-5208 vulnerabilities

Vulnerabilities for packages: kube-metrics-adapter, snyk-cli, gotenberg, temporal-ui-server, fq, temporal-ui-server-fips, temporal, kube-metrics-adapter-fips, temporal-fips...

GO-2024-2598 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, gcsfuse, cert-exporter, trillian-fips, temporal-server, logstash-exporter, flannel-cni-plugin, tigera-operator, smarter-device-manager, metrics-server-fips, prometheus-elasticsearch-exporter, nerdctl, cue-fips, scorecard, capsloc...

GO-2024-2609 vulnerabilities

Vulnerabilities for packages: kubernetes-dashboard-metrics-scraper, gcsfuse, cert-exporter, trillian-fips, temporal-server, logstash-exporter, flannel-cni-plugin, tigera-operator, smarter-device-manager, metrics-server-fips, prometheus-elasticsearch-exporter, nerdctl, cue-fips, scorecard, capsloc...

GO-2023-2402 vulnerabilities

Vulnerabilities for packages: libssh, trillian-fips, temporal-server, trivy, zot, tigera-operator, prometheus-stackdriver-exporter, metrics-server-fips, flux-kustomize-controller, crossplane-provider-azure-managedidentity, nerdctl, scorecard, crossplane-provider-azure-storage, kubeflow,...

GO-2025-3462 vulnerabilities

Vulnerabilities for packages: temporal-ui-server, temporal-server, temporal...

GO-2026-5208 vulnerabilities

Vulnerabilities for packages: snyk-cli, kube-metrics-adapter, temporal-ui-server, temporal, fq...

CLEANSTART-2026-UG13000 Security fixes in temporal-ui-server-fips 2.51.1-r1

Package temporal-ui-server-fips version 2.51.1-r1 fixes 36 vulnerabilities: CVE-2026-39828, CVE-2026-39829, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

EUVD-2026-56924

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655 Temporal UI Server may set OAuth credential cookies without Secure behind a TLS-terminating reverse proxy

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

CVE-2026-65655

Temporal UI Server may set OAuth credential cookies without Secure when TLS terminates at a reverse proxy and forwards callbacks to the UI server over HTTP. This can allow an attacker-controlled scenario to access access-token and possibly refresh-token cookies if the attacker can steer UI hostna...

CVE-2026-67179 Genkit improper host header validation

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

CVE-2026-67179

Genkit’s Dev UI server (default port 4000) suffers from improper validation of host request headers, enabling DNS rebinding to reach POST /api/runAction from any host on the developer’s network or any site the developer visits. This allows an attacker to execute any registered Genkit action and r...

PT-2026-70889

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

PT-2026-70265

Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits via DNS rebinding, can reach POST /api/runAction on the Dev UI server default port 4000 and execute any registered Genkit action and read the result. Fixed on 2026-06-...

CLEANSTART-2026-BQ82502 Security fixes in temporal-ui-server-fips 2.44.0-r0

Package temporal-ui-server-fips version 2.44.0-r0 fixes 2 vulnerabilities: CVE-2025-68121, CVE-2025-61732...

CVE-2026-47429 Vitest: Arbitrary file can be read and executed when Vitest UI server is listening

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /vitestattachment, allowing \?\..\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile...