Is CVE-2026-104355 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-104355 being exploited in the wild.

How severe is CVE-2026-104355?

Informational severity, published 12 October 2026.

How is CVE-2026-104355 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-104355?

Check whether you run Temporal Technologies Temporal Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-104355: Temporal Server local namespace modification via replication

CVE-2026-104355 · Severity: info · Published 2026-10-12

Temporal Server is a workflow orchestration platform used to manage distributed task execution. In multi-cluster deployments, an attacker who controls or compromises a registered peer cluster can modify local namespaces on a target cluster without authentication, including critical settings like retention policies and active cluster designation, potentially causing workflow failures and data loss.

Technologies: Temporal Technologies Temporal Server. Vendors: Temporal Technologies.

Quick answers

Is CVE-2026-104355 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-104355 being exploited in the wild.
How severe is CVE-2026-104355?: Informational severity, published 12 October 2026.
Which products and versions are affected?: Temporal Technologies Temporal Server.
Is there a fix for CVE-2026-104355?: No fixed version is recorded yet. Restrict cluster-to-cluster replication connections by disabling the connection flag for peer clusters in multi-cluster deployments until a patched version is available. Clusters with no remote cluster registered with connection enabled are not exposed. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-104355 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-104355?: Check whether you run Temporal Technologies Temporal Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Restrict cluster-to-cluster replication connections by disabling the connection flag for peer clusters in multi-cluster deployments until a patched version is available. Clusters with no remote cluster registered with connection enabled are not exposed.

Technical details

The vulnerability exists in the namespace replication task executor: the receiving cluster accepts inbound replication updates for local namespaces (which should never be replicated) and overwrites namespace state, description, owner, retention, archival settings, and cluster list without validating that the namespace is global. An attacker controlling a registered peer cluster can supply any local namespace name and identifier to modify its configuration, including the built-in temporal-system namespace, affecting History service replication tasks as well.

Affected products

Temporal Technologies Temporal Server

Timeline

2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.