Executive brief
Temporal Server, a workflow orchestration platform, can be forced to consume excessive CPU when handling Schedules with specific configurations. An authenticated attacker with namespace write permission can create a Schedule combining fine-grained timing rules with exclusion calendars designed to reject all candidate times, causing the server to continuously evaluate rejected times. This can degrade performance and cause service unavailability without exposing or modifying workflow data.
Technical details
The vulnerability is a resource exhaustion flaw in Schedule's next action time search logic. An authenticated user with namespace write permission can craft a Schedule specification with a fine-grained cadence and an exclusion calendar that rejects every candidate time, bypassing the per-search work budget. The malicious Schedule persists and causes the backing Schedule Workflow to repeatedly fail and retry, consuming CPU in Frontend and Schedule worker components without additional request overhead. Repeated or parallel exploitation amplifies the denial-of-service impact.
Affected products
- Temporal Technologies Temporal Server <unspecified; fix in commit c10c730
Timeline
- 2026-09-21: disclosed: CVE-2026-16652 published
- 2026-07-15: patched: Fix merged in commit c10c730 (List matching perf)