Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104355— Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces

Quick assessment

Affected
Temporal Technologies, Inc. Temporal Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

已连接的对等集群（peer cluster）可以修改时序服务器集群的本地命名空间，这些本地命名空间永远不会被复制给该对等集群，因为接收方集群会将来自传入的命名空间复制更新应用于这些本地命名空间。在多云集群部署中，每个集群会从管理员已注册并启用连接的对等集群中拉取复制任务；发送方会排除本地命名空间，但接收方不会应用相同的规则。当传入的任务引用一个已存在的命名空间时，服务器仅检查命名空间标识符是否匹配，然后覆盖其状态、描述、所有者、保留策略、归档设置和集群列表，并且在任务携带更高故障转移版本时还会覆盖其活跃集群，而不会

CVSS 7.0 · High EPSS 0.36% · P28

Affected Version Matrix 5

VendorProduct Version RangeStatus
Temporal Technologies, Inc. Temporal Server 0.0.0< 1.0.0 unknown
1.0.0≤ 1.29.7 affected
1.30.0< 1.30.8 affected
1.31.0< 1.31.4 affected
1.32.0< 1.32.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104355

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces
Source: CVE Program / CVE List V5
Vulnerability Description
A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote clusters an administrator has registered with connection enabled; the sending side excludes local namespaces, but the receiving side does not apply the same rule. When an inbound task names an existing namespace, the server checks at most that the namespace identifiers match, then overwrites its state, description, owner, retention, archival settings, and cluster list, and its active cluster when the task carries a higher failover version, without checking that the namespace is global. A party that controls a registered peer's replies, by operating or compromising it, can therefore change any local namespace whose name and identifier it can supply, without any credential on the receiving cluster: for example, marking it Deprecated, making the peer its active cluster, and shortening its retention, after which new Workflow starts in that namespace fail. Local namespaces include the built-in temporal-system namespace. Namespace metadata the History service refreshes from the peer while processing its history replication tasks passes through the same logic. A cluster with no remote cluster registered with connection enabled is not exposed.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Temporal Technologies, Inc. Temporal Server 1.0.0 ~ 1.29.7 cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-104355

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104355

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-104355 (4)

Vendor Pages for CVE-2026-104355 (1)

Other References for CVE-2026-104355 (1)

IV. Related Vulnerabilities

Same product: Temporal Server
Same vendor: Temporal Technologies, Inc.
Same weakness: CWE-863

V. Comments for CVE-2026-104355

No comments yet

Leave a comment