CVE-2026-89140
Received Received - Intake

Privilege Escalation in Temporal Server Scheduler

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: Temporal Technologies Inc.

Description
Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callbacks that Scheduler V2 attaches to the Workflows it starts. In affected releases, any authenticated caller could attach a callback with that address to a Workflow start request, the address was exempt from the component.callbacks.allowedAddresses allowlist, and the History service delivered the callback to the component its token named, in whatever namespace that was, without authorizing the original caller there. When the forged completion matches an action a target schedule is running, the schedule records the action as completed while its Workflow still runs, which can defeat an overlap policy such as SKIP, and passes caller-controlled data to the next scheduled Workflow as its last completion result. A forged failure may also pause a schedule configured to pause on failure. A forgery requires the target namespace identifier, the schedule identifier, and the identity and timing of a running action. No disclosure of Workflow payloads or history was identified. Only namespaces that hold Scheduler V2 schedules can be targeted; Scheduler V2 is off by default, and existing Scheduler V2 schedules remain targets after the settings that create them are turned off.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-89140
EUVD
EUVD-2026-97769

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Temporal Technologies, Inc. Temporal Server 1.30.0
Temporal Technologies, Inc. Temporal Server 1.31.0
Temporal Technologies, Inc. Temporal Server 1.32.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Temporal Server allows authenticated users with write permissions in one namespace to manipulate Scheduler V2 schedule states in another namespace by exploiting internal callback tokens. The system fails to bind callbacks to their originating namespace, enabling unauthorized cross-namespace operations through forged completion requests targeting temporal://internal.

Detection Guidance

Detecting this vulnerability requires checking Temporal Server configurations and logs for unauthorized internal callback attempts. Review callback tokens in workflow execution logs for namespace mismatches or malformed references. Use server metrics to identify unusual callback patterns targeting temporal://internal from unexpected namespaces.

Impact Analysis

An attacker could alter scheduled workflows in unrelated namespaces, potentially causing workflows to skip steps, receive false completion data, or pause unexpectedly. This requires knowledge of target namespace identifiers and schedule IDs but does not expose workflow payloads or history.

Compliance Impact

The vulnerability allows authenticated users with write permissions in one namespace to manipulate scheduler schedules in another namespace by forging internal callbacks. This could potentially lead to unauthorized data access or modification, which may violate compliance requirements for data integrity and access controls in standards like GDPR and HIPAA.

Mitigation Strategies
  • Upgrade Temporal Server to v1.30.8, v1.31.4, or v1.32.1 or later versions that include the fix.
  • Verify the dynamic configuration callback.internal.sameNamespaceArchetypes is set to enforce same-namespace callbacks for all relevant archetypes.
  • Audit existing schedules and workflows for unauthorized cross-namespace callbacks, particularly those using temporal://internal.
  • Monitor callback validation logs for namespace mismatch errors after applying the update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89140. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart