Executive brief
Temporal Server, a workflow orchestration platform, allows authenticated users with limited write permissions to escalate their privileges and perform administrative actions in other namespaces. An attacker can craft a malicious callback that tricks the server's internal API into executing unauthorized API calls with system administrator privileges, enabling actions like terminating workflows, registering namespaces, or modifying configurations they should not access.
Technical details
The vulnerability exists in the callback delivery logic (both HSM and CHASM implementations) where the History service uses a caller-supplied HTTP header to determine if a callback is internal. An authenticated attacker with namespace-scoped write permissions can attach a completion callback with a non-empty source header; when delivered, the server rewrites only scheme/host while preserving the attacker's path/query/body and sends the request to the internal frontend, which authorizes it as a system administrator without authentication. In versions 1.30.0+, any non-empty source header triggers the vulnerability; in versions 1.25.0-1.29.7, the header must match a cluster ID UUID.
Affected products
- Temporal Server 1.25.0 and later
Timeline
- 2026-09-21: disclosed