CVE-2026-104355: Incorrect Authorization

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

CVE-2026-89140: Authorization Bypass Through User-Controlled Key

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callback...

CVE-2026-78669 vulnerabilities

Vulnerabilities for packages: backup-restore-operator-fips, coredns-fips, mesosphere-vsphere-csi-fips, kyverno-policy-reporter-kyverno-plugin, minio-fips, nuclio-controller, helmfile, victoriametrics, virt-operator, gitlab-workhorse-ce, stern, spark-operator-fips, crossplane-provider-aws-ecs-fips...

GO-2026-6611 vulnerabilities

Vulnerabilities for packages: backup-restore-operator-fips, coredns-fips, mesosphere-vsphere-csi-fips, kyverno-policy-reporter-kyverno-plugin, minio-fips, nuclio-controller, helmfile, victoriametrics, virt-operator, gitlab-workhorse-ce, stern, spark-operator-fips, crossplane-provider-aws-ecs-fips...

GO-2026-6612 vulnerabilities

Vulnerabilities for packages: backup-restore-operator-fips, coredns-fips, mesosphere-vsphere-csi-fips, kyverno-policy-reporter-kyverno-plugin, minio-fips, nuclio-controller, helmfile, victoriametrics, virt-operator, gitlab-workhorse-ce, stern, spark-operator-fips, crossplane-provider-aws-ecs-fips...

GO-2026-6617 vulnerabilities

Vulnerabilities for packages: backup-restore-operator-fips, coredns-fips, mesosphere-vsphere-csi-fips, kyverno-policy-reporter-kyverno-plugin, minio-fips, nuclio-controller, helmfile, victoriametrics, virt-operator, gitlab-workhorse-ce, stern, spark-operator-fips, crossplane-provider-aws-ecs-fips...

CVE-2026-78659 vulnerabilities

Vulnerabilities for packages: backup-restore-operator-fips, coredns-fips, mesosphere-vsphere-csi-fips, kyverno-policy-reporter-kyverno-plugin, minio-fips, nuclio-controller, helmfile, victoriametrics, virt-operator, gitlab-workhorse-ce, stern, spark-operator-fips, crossplane-provider-aws-ecs-fips...

GO-2026-6603 vulnerabilities

Vulnerabilities for packages: backup-restore-operator-fips, coredns-fips, mesosphere-vsphere-csi-fips, kyverno-policy-reporter-kyverno-plugin, minio-fips, nuclio-controller, helmfile, victoriametrics, virt-operator, gitlab-workhorse-ce, stern, spark-operator-fips, crossplane-provider-aws-ecs-fips...

CLEANSTART-2026-UZ23021 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the temporal-server-fips package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

CLEANSTART-2026-HL09755 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the temporal-server-fips package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-RM10286 filippo

Security vulnerability affects the temporal-server-fips package. filippo...

CLEANSTART-2026-FN36797 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the temporal-server package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-PB13489 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the temporal-server package. gRPC-Go is the Go language implementation of gRPC...

CLEANSTART-2026-UP81071 Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0

Security vulnerability affects the temporal-server package. Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0...

CLEANSTART-2026-HI18999 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the temporal-server package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-OX02272 Security fix for GHSA-259r-337f-4rfw applied in: dex-fips 2.42.1-r5, nfs-subdir-external-provisioner 4.0.2-r2, temporal-server 1.31.3-r2

GHSA-259r-337f-4rfw affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-YK14292 OpenTelemetry-Go is the Go implementation of OpenTelemetry

Security vulnerability affects the temporal-server package. OpenTelemetry-Go is the Go implementation of OpenTelemetry...

CLEANSTART-2026-MX72137 CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute

Security vulnerability affects the temporal-server package. CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a tag's attribute...

CLEANSTART-2026-GZ31996 Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used

Security vulnerability affects the temporal-server package. Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used...

CLEANSTART-2026-MM79132 Actions which insert URLs into the content attribute of HTML meta tags are not escaped

Security vulnerability affects the temporal-server package. Actions which insert URLs into the content attribute of HTML meta tags are not escaped...