23 matches found
CVE-2026-89139
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
CVE-2026-89139
Temporal Server versions 1.31.0 through
CVE-2026-89139 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
CVE-2026-89139 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
CVE-2026-89139 Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
EUVD-2026-83897
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
CVE-2026-89139: Improper Neutralization of Special Elements used in an OS Command
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that...
PT-2026-96079
Name of the Vulnerable Software and Affected Versions Temporal Server versions 1.31.0 through 1.31.2 Description The Worker Service in Temporal Server includes a Worker Controller Instance module that registers a compute provider named subprocess. This provider allows the execution of commands on...
Budibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings
Summary The GET /api/global/groups endpoint on the worker service has no role-based authorization middleware. Any authenticated user including BASIC role can enumerate all user groups in the tenant, including their role mappings, user memberships, builder permissions, and the isDefault flag. Step...
CVE-2026-35053: Missing Authentication for Critical Function
OneUptime is an open-source monitoring and observability platform. Prior to version 10.0.42, the Worker service's ManualAPI exposes workflow execution endpoints GET /workflow/manual/run/:workflowId and POST /workflow/manual/run/:workflowId without any authentication middleware. An attacker who ca...
PT-2026-29883
Name of the Vulnerable Software and Affected Versions OneUptime versions prior to 10.0.42 Description The OneUptime platform's Worker service ManualAPI exposes workflow execution endpoints without authentication. Specifically, the GET and POST endpoints /workflow/manual/run/:workflowId are...
Malicious Package
Overview indexer-worker-service is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
MAL-2025-6098 Malicious code in indexer-worker-service (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac1787e896bcd8c295f599ea997c10b250926208aa47d4407a3b796c4033e349 Any computer that has this package installed or running should be considered...
Malicious code in worker-service (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-3960 Malicious code in worker-service (npm)
--- -= Per source details. Do not edit below this line.=-...
Mozilla: Use-after-free in SharedWorkerService
The Mozilla Foundation Security Advisory describes this flaw as: When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash...
Mozilla: Use-after-free in SharedWorkerService
The Mozilla Foundation Security Advisory describes this flaw as: When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash...
Mozilla: Use-after-free in SharedWorkerService
The Mozilla Foundation Security Advisory describes this flaw as: When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash...
Mozilla: Use-after-free in SharedWorkerService
The Mozilla Foundation Security Advisory describes this flaw as: When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash...
Mozilla: Use-after-free in SharedWorkerService
The Mozilla Foundation Security Advisory describes this flaw as: When browsing a malicious page, a race condition in our SharedWorkerService could occur and lead to a potentially exploitable crash...