CVE-2026-120091

Temporal Server is vulnerable to OS command injection because the k8s compute provider (part of the go.temporal.io/auto-scaled-workers module) builds a Kubernetes client using caller-supplied configuration instead of operator configuration. An authenticated caller with only a read role in a singl...