CVE-2026-87858— Temporal Server 管理权限劫持漏洞
一分钟漏洞结论
影响对象
Temporal Technologies, Inc. Temporal Server
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Temporal Server 通过读取由调用方提供的 HTTP 头来决定工作流（Workflow）完成回调（completion callback）是否为内部请求。拥有单个命名空间（namespace）写权限的经过身份验证的调用方，可以附加一个完成回调，其 URL 主机匹配配置的回调地址白名单，URL 路径为任意 Temporal HTTP API 路由，且其 HTTP 头映射中包含一个非空的名为 的头。当 History 服务分发该回调时，非空的 头会导致其将请求重新定向到本地前端客户端，并重写方案和主机，同时
影响版本矩阵 3
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Temporal Technologies, Inc. | Temporal Server | 1.30.0< 1.30.7 |
affected |
1.31.0< 1.31.3 |
affected | ||
1.25.0≤ 1.29.7 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-87858 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
来源: CVE Program / CVE List V5
Vulnerability Description
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving the caller's path, query, and request body. Where an internal frontend is deployed with its HTTP API enabled, that client resolves to the internal frontend, which authorizes every request as a system administrator without requiring authentication information. The result is that the server performs an attacker-chosen state-changing HTTP POST against its own administrative API on the caller's behalf, in namespaces where the caller has no permission. The caller never needs network access to the internal frontend, because the History service makes the request. Confirmed effects include terminating Workflows in other namespaces, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The affected routing logic is present in both the HSM and CHASM callback delivery implementations. This description and the CVSS score in this record describe releases 1.30.0 and later, where any non-empty source header is sufficient. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect in which the header must exactly match a configured cluster ID, a UUID that a namespace-scoped caller cannot read through the API. The consequence once that match occurs is the same, but the attack is materially harder and scores lower. To determine whether a deployment is affected, check two settings together: the static Server configuration for a non-zero services.internal-frontend.rpc.httpPort, and the effective per-namespace dynamic configuration value of component.callbacks.allowedAddresses. A deployment is exposed only when an internal frontend is deployed with a non-zero HTTP port, at least one allowlist rule admits a host, and authorization is enabled. The allowlist is empty by default, which denies all external callback URLs, and the stock static topology does not include an internal frontend. Note that a failed attach returns the error 'invalid url: url does not match any configured callback address', which proves only that one tested URL did not match and does not prove the effective allowlist is empty. To look for callbacks already attached, use DescribeWorkflowExecution, which returns callback information for a Workflow's registered completion callbacks. Operators should be aware of a gap when searching for evidence of delivery: the frontend HTTP API server records the request method and URL at debug level only, so at default log levels a delivered request is not written to the internal frontend's logs, and the absence of such log entries is not evidence that the issue was not exploited.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
在安全决策中依赖未经信任的输入
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Temporal Technologies, Inc. | Temporal Server | 1.30.0 ~ 1.30.7 |
cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*
|
|
| Temporal Technologies, Inc. | Temporal Server | 1.25.0 ~ 1.29.7 |
cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*
|
|
二、漏洞 CVE-2026-87858 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-87858 的情报信息
请登录查看更多情报信息。
CVE-2026-87858 补丁与修复 (2)
CVE-2026-87858 其他参考 (3)
-
🔗 Release v1.32.0 · temporalio/temporal · GitHub release-notes
-
-
🔗 Release v1.30.7 · temporalio/temporal · GitHub release-notes
同批安全公告 · Temporal Technologies, Inc. · 2026-09-21 · 共 8 条
| CVE-2026-89139 | 8.7 HIGH | Temporal Server Worker部署远程命令执行漏洞 |
| CVE-2026-65653 | 8.7 HIGH | Tchannel-Go 零长度分片调用致进程终止 |
| CVE-2026-65654 | 8.7 HIGH | Ringpop-go 入站成员 gossip 未执行标签限制 |
| CVE-2026-65652 | 8.7 HIGH | tchannel-go 校验和类型错误导致进程终止漏洞 |
| CVE-2026-16652 | 7.1 HIGH | Temporal Server 调度排除搜索致 CPU 高耗 |
| CVE-2026-16651 | 7.1 HIGH | Temporal sqlparser MySQL版本注释致Panic |
| CVE-2026-65651 | 6.0 MEDIUM | temporalio/sqlparser 深层嵌套表达式栈溢出漏洞 |