CVE-2026-89140: Temporal Server namespace bypass in internal completion callbacks

CVE-2026-89140 · Severity: info · Published 2026-10-12

Temporal Server, a workflow orchestration platform, failed to validate that internal completion callbacks were bound to the correct namespace. An authenticated user with write access in one namespace could forge callbacks to manipulate scheduled workflows in a different namespace, potentially skipping scheduled tasks or injecting malicious data into the next workflow execution.

Technologies: Temporal Technologies Temporal Server. Vendors: Temporal Technologies.

Quick answers

Is CVE-2026-89140 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-89140 being exploited in the wild.
How severe is CVE-2026-89140?
Informational severity, published 12 October 2026.
Which products and versions are affected?
Temporal Technologies Temporal Server.
Is there a fix for CVE-2026-89140?
Yes: fixed in Versions after commit a210eeb8c2cc7e22338bb4f552ff1171d8f35969 (2026-09-30). Until then: If Scheduler V2 is not in use, disable it to prevent attack surface. Restrict authentication credentials to minimize exposure of accounts with write permissions across multiple namespaces. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-89140 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-89140?
Check whether you run Temporal Technologies Temporal Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: Versions after commit a210eeb8c2cc7e22338bb4f552ff1171d8f35969 (2026-09-30)

If Scheduler V2 is not in use, disable it to prevent attack surface. Restrict authentication credentials to minimize exposure of accounts with write permissions across multiple namespaces.

Technical details

The History service delivered internal callbacks (reserved address temporal://internal) without validating that the caller was authorized in the target namespace. An authenticated attacker could attach a forged completion callback matching a running action in another namespace to trigger premature completion, defeat overlap policies like SKIP, or inject caller-controlled data into subsequent scheduled workflows. The vulnerability affects only Scheduler V2 (off by default) and requires knowledge of the target namespace identifier, schedule identifier, and action timing.

Affected products

  • Temporal Technologies Temporal Server

Timeline

  • 2026-10-12: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.