Executive brief
Temporal Server's Worker Service compiles a subprocess compute provider that can launch worker processes by executing arbitrary commands on the host machine. An authenticated user with write access to any namespace can exploit this to execute commands under the server process's account, potentially compromising the entire cluster since the Worker Service holds persistence credentials and TLS material for all namespaces. The vulnerability affects default deployments running Temporal Server 1.31.0 through 1.31.2 with authorization enabled and no compute provider allowlist configured.
Technical details
The subprocess compute provider in Temporal Server's Worker Controller Instance module accepts program name and arguments from untrusted request parameters rather than operator configuration, allowing authenticated callers to inject arbitrary commands. The vulnerability is triggered immediately during configuration validation via the invoke strategy, with no deferred execution or special preconditions required beyond a write role in any namespace. Mitigation requires restricting the compute provider allowlist via workercontroller.compute_providers.enabled dynamic configuration, which defaults to permitting all providers when unset.
Affected products
- Temporal Technologies Temporal Server 1.31.0 to 1.31.2
Timeline
- 2026-09-21: disclosed