CVE-2026-16652
Received Received - Intake

Temporal Server Unbounded CPU Consumption via Schedule Exclusion

Publication date: 2026-09-21

Last updated on: 2026-09-21

Assigner: Temporal Technologies Inc.

Description
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-21
Last Modified
2026-09-21
Generated
2026-09-21
AI Q&A
2026-09-21
EPSS Evaluated
N/A
NVD
CVE-2026-16652
EUVD
EUVD-2026-83884

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
temporal temporal_server *
temporal temporal *
temporal temporal From 1.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-606 The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Temporal Server allows an authenticated user with namespace write permission to create or update a Schedule with a fine-grained cadence and an exclusion calendar that rejects every candidate time. This causes the server to repeatedly evaluate excluded candidates without a work budget, consuming excessive CPU in Frontend and Schedule worker components. The issue only affects availability and does not expose or modify Workflow data.

Detection Guidance

Monitor CPU usage spikes in Temporal Frontend and Schedule worker components. Check logs for repeated failures in Schedule Workflow retries or excessive computation warnings during schedule time searches. Use Temporal server metrics endpoints to track schedule processing times and resource consumption.

Impact Analysis

An attacker could exploit this to cause denial of service by consuming excessive CPU resources, leading to degraded performance or unavailability of the Temporal Server. This could disrupt workflow processing and scheduling operations until the malicious Schedule is removed or its backing Workflow is terminated.

Compliance Impact

This vulnerability primarily impacts system availability by consuming excessive CPU resources, which could lead to service denial. It does not expose or modify data, so direct impacts on GDPR or HIPAA compliance are unlikely unless service disruption affects data processing or access.

Mitigation Strategies

Apply the patch from Pull Request #11014 or update to a fixed Temporal Server version. Monitor schedule processing with dynamic configuration limits for warnings and errors. Adjust compute limits gradually while testing V1 schedule compatibility to avoid service disruption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16652. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart