CVE-2026-89139: Temporal Server arbitrary command execution via subprocess compute provider

CVE-2026-89139 · Severity: info · Published 2026-09-21

Temporal Server's Worker Service compiles a subprocess compute provider that can launch worker processes by executing arbitrary commands on the host machine. An authenticated user with write access to any namespace can exploit this to execute commands under the server process's account, potentially compromising the entire cluster since the Worker Service holds persistence credentials and TLS material for all namespaces. The vulnerability affects default deployments running Temporal Server 1.31.0 through 1.31.2 with authorization enabled and no compute provider allowlist configured.

Technologies: Temporal Technologies Temporal Server. Vendors: Temporal Technologies.

Quick answers

Is CVE-2026-89139 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-89139 being exploited in the wild.
How severe is CVE-2026-89139?
Informational severity, published 21 September 2026.
Which products and versions are affected?
Temporal Technologies Temporal Server 1.31.0 to 1.31.2.
Is there a fix for CVE-2026-89139?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-89139 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-89139?
Check whether you run Temporal Technologies Temporal Server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The subprocess compute provider in Temporal Server's Worker Controller Instance module accepts program name and arguments from untrusted request parameters rather than operator configuration, allowing authenticated callers to inject arbitrary commands. The vulnerability is triggered immediately during configuration validation via the invoke strategy, with no deferred execution or special preconditions required beyond a write role in any namespace. Mitigation requires restricting the compute provider allowlist via workercontroller.compute_providers.enabled dynamic configuration, which defaults to permitting all providers when unset.

Affected products

  • Temporal Technologies Temporal Server 1.31.0 to 1.31.2

Timeline

  • 2026-09-21: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.