Is CVE-2026-5199 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-5199 being exploited in the wild.

How severe is CVE-2026-5199?

Medium severity, with a CVSS score of 4, published 1 April 2026.

Which products and versions are affected?

go.temporal.io/server (Go) SEMVER:introduced=0,fixed=1.29.5,introduced=1.30.0-143.0,fixed=1.30.3, SEMVER:introduced=1.30.0-143.0,fixed=1.30.3; Temporal Technologies Temporal Server >= 1.29.0, = 1.30.0, < 1.30.3.

Is there a fix for CVE-2026-5199?

Yes. go.temporal.io/server (Go): upgrade to 1.30.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-5199 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-5199?

Check whether you run go.temporal.io/server (Go) or Temporal Technologies Temporal Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5199: Temporal Server authorization bypass in batch workflow operations

Q: Is there a fix for CVE-2026-5199?

Yes. go.temporal.io/server (Go): upgrade to 1.30.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-5199 attacked?

It is attacked over the network, in a hosted service.

Q: Am I affected by CVE-2026-5199?

Check whether you run go.temporal.io/server (Go) or Temporal Technologies Temporal Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-5199 · Severity: medium · CVSS 4 · Published 2026-04-01

Temporal Server is an open-source platform used to manage and execute complex business workflows. A security flaw in the system's batch processing allows a user with 'writer' permissions in one workspace (namespace) to potentially interfere with workflows in a different workspace on the same server. An attacker could delete, reset, or send signals to a victim's tasks if they know the specific workflow IDs, potentially disrupting business operations or causing data inconsistency.

Technologies: go.temporal.io/server (Go), Temporal Technologies Temporal Server. Vendors: Go, Temporal Technologies.

Quick answers

Is CVE-2026-5199 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-5199 being exploited in the wild.
How severe is CVE-2026-5199?: Medium severity, with a CVSS score of 4, published 1 April 2026.
Which products and versions are affected?: go.temporal.io/server (Go) SEMVER:introduced=0,fixed=1.29.5,introduced=1.30.0-143.0,fixed=1.30.3, SEMVER:introduced=1.30.0-143.0,fixed=1.30.3; Temporal Technologies Temporal Server >= 1.29.0, < 1.29.5; >= 1.30.0, < 1.30.3.
Is there a fix for CVE-2026-5199?: Yes. go.temporal.io/server (Go): upgrade to 1.30.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-5199 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-5199?: Check whether you run go.temporal.io/server (Go) or Temporal Technologies Temporal Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

go.temporal.io/server (Go): upgrade to 1.30.3 or later
```
go get go.temporal.io/server@v1.30.3
```

Technical details

An authorization bypass (CWE-639) exists in Temporal Server's batch activity code. While the system validated the namespace ID, it failed to cross-check the user-provided namespace name against the worker's bound namespace. This allows a worker with privileged credentials in one namespace to operate on an arbitrary namespace if the server is configured with cross-namespace authorization (e.g., internal-frontend service or specific TLS-based internal identities). To exploit this, an attacker must have 'writer' role access and knowledge of the victim's specific workflow IDs and signal names. The issue was introduced in v1.29.0 and is patched in v1.29.5 and v1.30.3.

Affected products

Temporal Technologies Temporal Server >= 1.29.0, < 1.29.5; >= 1.30.0, < 1.30.3

Identifiers

CVE-2026-5199
GHSA-xpg8-3hhp-p7w8
GO-2026-5766

Timeline

2026-04-01: disclosed
2026-04-01: patched: Versions 1.29.5 and 1.30.3 released
2026-04-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.