CVE-2026-108126

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

CVE-2026-108126 temporal-proxy payload decryption is not bound to the request namespace

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

EUVD-2026-102301

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

CVE-2026-108126

Versions 0.2.0 through 0.8.0 of temporal-proxy are vulnerable to an authorization bypass because encrypted payloads are not bound to specific namespaces. When encryption is enabled, the proxy selects decryption keys based on an identifier inside the payload rather than the request's namespace. Th...