Is CVE-2026-87857 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-87857 being exploited in the wild.

How severe is CVE-2026-87857?

Informational severity, published 9 November 2026.

How is CVE-2026-87857 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-87857?

Check whether you run Temporal Technologies Temporal Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-87857: Temporal Server workflow-history pagination token namespace bypass

CVE-2026-87857 · Severity: info · Published 2026-11-09

Temporal Server, a platform for managing durable workflows, stores pagination tokens for workflow history queries without cryptographic binding to the namespace and workflow being accessed. An authenticated user with read access to one namespace can submit a previously-issued continuation token from a workflow in a different namespace to access that workflow's history without proper authorization, provided both namespaces' workflows map to the same underlying storage shard. This allows cross-namespace history disclosure to users who hold a legitimate token from a different workflow.

Technologies: Temporal Technologies Temporal Server. Vendors: Temporal Technologies.

Quick answers

Is CVE-2026-87857 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-87857 being exploited in the wild.
How severe is CVE-2026-87857?: Informational severity, published 9 November 2026.
Which products and versions are affected?: Temporal Technologies Temporal Server.
Is there a fix for CVE-2026-87857?: No fixed version is recorded yet. Search History service warning logs for the message "Pagination branch token is not the execution's current branch token" with reason=foreign_branch to detect potential exploitation in unpatched versions; upgrade to a fixed release to enable enforcement and logging of pagination token branch validation. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-87857 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-87857?: Check whether you run Temporal Technologies Temporal Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Search History service warning logs for the message "Pagination branch token is not the execution's current branch token" with reason=foreign_branch to detect potential exploitation in unpatched versions; upgrade to a fixed release to enable enforcement and logging of pagination token branch validation.

Technical details

The vulnerability stems from GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse operations authorizing the caller against the request's namespace, then fetching history using an unauthenticated, serialized protobuf continuation token that lacks namespace or workflow identity binding. An attacker can reuse a continuation token from one namespace in a request naming a different namespace; the operation succeeds if both workflows map to the same History shard. Additionally, because tokens are unauthenticated, a holder can modify the event range and persistence cursor to access events created after their access credentials expired.

Affected products

Temporal Technologies Temporal Server

Timeline

2026-11-09: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.