CVE-2026-104355

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

CVE-2026-104355

A Temporal Server cluster is vulnerable to unauthorized modification of its local namespaces (including the built-in temporal-system namespace) when connected to a registered peer cluster. The root cause is an incorrect authorization logic where the receiving cluster fails to verify if a namespac...