Is CVE-2026-65655 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-65655 being exploited in the wild.

How severe is CVE-2026-65655?

Informational severity, published 11 August 2026.

Which products and versions are affected?

Temporal Technologies UI Server before a fix version (version details not specified in advisory).

Is there a fix for CVE-2026-65655?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-65655 attacked?

It is attacked from the adjacent network or over the network.

Am I affected by CVE-2026-65655?

Check whether you run Temporal Technologies UI Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-65655: Temporal UI Server insecure OAuth cookie in reverse proxy setup

CVE-2026-65655 · Severity: info · Published 2026-08-11

Temporal UI Server is a web interface for managing Temporal workflow orchestration. When OAuth login is enabled behind a reverse proxy that terminates TLS on the browser side but forwards to the server over unencrypted HTTP, authentication cookies are issued without the Secure flag, allowing them to be transmitted over plaintext connections. An attacker who controls the victim's network or DNS could steal these credentials and replay them within the victim's permissions.

Vendors: Temporal Technologies.

Quick answers

Is CVE-2026-65655 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-65655 being exploited in the wild.
How severe is CVE-2026-65655?: Informational severity, published 11 August 2026.
Which products and versions are affected?: Temporal Technologies UI Server before a fix version (version details not specified in advisory).
Is there a fix for CVE-2026-65655?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-65655 attacked?: It is attacked from the adjacent network or over the network.
Am I affected by CVE-2026-65655?: Check whether you run Temporal Technologies UI Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an insecure cookie configuration (missing Secure flag) in OAuth authentication flow. The root cause is that Temporal UI Server derives the cookie's Secure attribute from the proxy-to-server connection rather than the browser-facing connection. When TLS terminates at a reverse proxy and the proxy forwards the OAuth callback over HTTP to the server, the server incorrectly issues access-token and refresh-token cookies without the Secure flag, despite the browser completing login over HTTPS. Exploitation requires the attacker to intercept the connection between browser and proxy, prevent HTTPS success, and serve the hostname over HTTP to capture the cookie in plaintext. HSTS, HTTPS-only warnings, or re-encryption between proxy and server can prevent this attack.

Affected products

Temporal Technologies UI Server before a fix version (version details not specified in advisory)

Timeline

2026-08-11: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.