CVE-2026-104355
Received Received - Intake

Namespace Modification in Temporal Server via Peer Cluster

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Temporal Technologies Inc.

Description
A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote clusters an administrator has registered with connection enabled; the sending side excludes local namespaces, but the receiving side does not apply the same rule. When an inbound task names an existing namespace, the server checks at most that the namespace identifiers match, then overwrites its state, description, owner, retention, archival settings, and cluster list, and its active cluster when the task carries a higher failover version, without checking that the namespace is global. A party that controls a registered peer's replies, by operating or compromising it, can therefore change any local namespace whose name and identifier it can supply, without any credential on the receiving cluster: for example, marking it Deprecated, making the peer its active cluster, and shortening its retention, after which new Workflow starts in that namespace fail. Local namespaces include the built-in temporal-system namespace. Namespace metadata the History service refreshes from the peer while processing its history replication tasks passes through the same logic. A cluster with no remote cluster registered with connection enabled is not exposed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-104355
EUVD
EUVD-2026-97768

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Temporal Technologies, Inc. Temporal Server 1.0.0
Temporal Technologies, Inc. Temporal Server 1.30.0
Temporal Technologies, Inc. Temporal Server 1.31.0
Temporal Technologies, Inc. Temporal Server 1.32.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a connected peer cluster to modify a Temporal Server cluster's local namespaces without proper validation. The receiving cluster applies inbound namespace replication updates without checking if the namespace is global, enabling an attacker controlling a peer to alter namespace settings like state, retention, or active cluster, potentially causing workflow failures.

Detection Guidance

Detecting this vulnerability requires checking Temporal Server configurations and logs for unauthorized namespace replication attempts. Monitor logs for replication task processing errors or warnings related to local namespace modifications. Use commands like `go test ./common/namespace/nsreplication ./service/history/replication` to verify namespace replication logic integrity.

Impact Analysis

An attacker could exploit this to change critical namespace settings, such as marking namespaces as deprecated, altering retention periods, or redirecting workflows to fail. This could disrupt operations, cause data loss, or lead to unauthorized access to workflows and data in affected namespaces.

Compliance Impact

This vulnerability could lead to unauthorized modifications of namespace data, potentially violating data integrity and access control requirements under GDPR and HIPAA. Unauthorized changes to retention settings or namespace state may result in non-compliance with data protection and audit requirements.

Mitigation Strategies

Disable remote cluster connections with namespace replication enabled. Ensure no peer clusters are registered with connection enabled unless absolutely necessary. Audit all registered peer clusters and remove any untrusted ones.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104355. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart