CVE-2026-87857— Temporal Server 工作流历史分页令牌未绑定命名空间漏洞
一分钟漏洞结论
影响对象
Temporal Technologies, Inc. Temporal Server
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Temporal Server 未将工作流历史分页令牌（pagination token）绑定到请求中所指定的命名空间（namespace）和工作流名称。 和 接口首先根据请求中的命名空间对调用者进行授权，随后从调用者提供的 中记录的分支（branch）选取历史数据。常规的历史延续（continuation）包含运行标识符（run identifier）、事件边界（event bounds）、持久化游标（persistence cursor）和分支令牌（branch token），但不包含命名空间或工作流身份标识；
影响版本矩阵 4
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Temporal Technologies, Inc. | Temporal Server | 0.0.0< 1.0.0 |
unknown |
1.0.0≤ 1.29.7 |
affected | ||
1.30.0< 1.30.7 |
affected | ||
1.31.0< 1.31.3 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-87857 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Temporal Server workflow-history pagination token is not bound to the requested namespace and workflow
来源: CVE Program / CVE List V5
Vulnerability Description
Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace's workflow history, provided the supplied workflow identifier selects the same History shard as the continuation's branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller's current credential no longer granted access to the continuation's namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token's branch token is not the requested execution's current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading "Pagination branch token is not the execution's current branch token" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
通过用户控制密钥绕过授权机制
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Temporal Technologies, Inc. | Temporal Server | 1.0.0 ~ 1.29.7 |
cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*
|
|
二、漏洞 CVE-2026-87857 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-87857 的情报信息
请登录查看更多情报信息。
CVE-2026-87857 其他参考 (3)
-
🔗 Release v1.32.0 · temporalio/temporal · GitHub release-notes
-
-
🔗 Release v1.30.7 · temporalio/temporal · GitHub release-notes