Executive brief
Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts in go.temporal.io/server
Affected products
- Go go.temporal.io/server
Junglewise Threat Intelligence
CVE-2025-14986: GO-2025-4272 - Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts in go.temporal.io/server
CVE-2025-14986 · Severity: medium · CVSS 4 · Published 2026-01-12
Technologies: go.temporal.io/server (Go). Vendors: Go.
Related threats
- Temporal Server missing authentication in gRPC streaming interceptor
- Temporal Server authorization bypass in batch workflow operations
- GO-2026-4273 - Temporal has an Incorrect Authorization vulnerability in go.temporal.io/server
- GO-2025-3953 - Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling in go.temporal.io/server
- GO-2023-1879 - Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource in go.temporal.io/server