# CVE-2026-5199: Temporal Server authorization bypass in batch workflow operations

Source: https://junglewise.ai/threats/cve-2026-5199-temporal-server-authorization-bypass-in-batch-workflow-operations  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-01. Updated: 2026-07-21  
License: CC BY 4.0 with a link back

CVE-2026-5199 · Severity: medium · CVSS 4 · Published 2026-04-01

Temporal Server is an open-source platform used to manage and execute complex business workflows. A security flaw in the system's batch processing allows a user with 'writer' permissions in one workspace (namespace) to potentially interfere with workflows in a different workspace on the same server. An attacker could delete, reset, or send signals to a victim's tasks if they know the specific workflow IDs, potentially disrupting business operations or causing data inconsistency.

Technologies: [go.temporal.io/server (Go)](https://junglewise.ai/threats/technologies/go-temporal-io-server), [Temporal Technologies Temporal Server](https://junglewise.ai/threats/technologies/temporal-server). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Temporal Technologies](https://junglewise.ai/threats/vendors/temporal-technologies).

## Quick answers

**Is CVE-2026-5199 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5199 being exploited in the wild.

**How severe is CVE-2026-5199?** Medium severity, with a CVSS score of 4, published 1 April 2026.

**Which products and versions are affected?** go.temporal.io/server (Go) SEMVER:introduced=0,fixed=1.29.5,introduced=1.30.0-143.0,fixed=1.30.3, SEMVER:introduced=1.30.0-143.0,fixed=1.30.3; Temporal Technologies Temporal Server >= 1.29.0, < 1.29.5; >= 1.30.0, < 1.30.3.

**Is there a fix for CVE-2026-5199?** Yes. go.temporal.io/server (Go): upgrade to 1.30.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5199 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-5199?** Check whether you run go.temporal.io/server (Go) or Temporal Technologies Temporal Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- go.temporal.io/server (Go): upgrade to 1.30.3 or later

  ```sh
  go get go.temporal.io/server@v1.30.3
  ```


## Technical details

An authorization bypass (CWE-639) exists in Temporal Server's batch activity code. While the system validated the namespace ID, it failed to cross-check the user-provided namespace name against the worker's bound namespace. This allows a worker with privileged credentials in one namespace to operate on an arbitrary namespace if the server is configured with cross-namespace authorization (e.g., internal-frontend service or specific TLS-based internal identities). To exploit this, an attacker must have 'writer' role access and knowledge of the victim's specific workflow IDs and signal names. The issue was introduced in v1.29.0 and is patched in v1.29.5 and v1.30.3.

## Affected products

- Temporal Technologies Temporal Server >= 1.29.0, < 1.29.5; >= 1.30.0, < 1.30.3

## Identifiers

- CVE-2026-5199
- GHSA-xpg8-3hhp-p7w8
- GO-2026-5766

## Timeline

- 2026-04-01: disclosed
- 2026-04-01: patched: Versions 1.29.5 and 1.30.3 released
- 2026-04-01: advisory

## References

- [https://github.com/temporalio/temporal/releases/tag/v1.29.5](https://github.com/temporalio/temporal/releases/tag/v1.29.5)
- [https://github.com/temporalio/temporal/releases/tag/v1.30.3](https://github.com/temporalio/temporal/releases/tag/v1.30.3)

## Related threats

- [Temporal Server workflow-history pagination token namespace bypass](https://junglewise.ai/threats/cve-2026-87857-temporal-server-does-not-bind-a-workflow-history-pagination-token)
- [Temporal Server arbitrary command execution via Kubernetes worker configuration](https://junglewise.ai/threats/cve-2026-120091-temporal-server-compiles-a-worker-controller-instance-module-go)
- [Temporal Server namespace bypass in internal completion callbacks](https://junglewise.ai/threats/cve-2026-89140-temporal-server-does-not-bind-internal-completion-callbacks-to)
- [Temporal Server local namespace modification via replication](https://junglewise.ai/threats/cve-2026-104355-a-connected-peer-cluster-can-modify-a-temporal-server-cluster-s)
- [Temporal Server arbitrary command execution via subprocess compute provider](https://junglewise.ai/threats/cve-2026-89139-temporal-server-compiles-a-worker-controller-instance-module-into)