Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-87858— Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

Quick assessment

Affected
Temporal Technologies, Inc. Temporal Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the conf

CVSS 7.2 · High EPSS 0.43% · P37

Affected Version Matrix 3

VendorProduct Version RangeStatus
Temporal Technologies, Inc. Temporal Server 1.30.0< 1.30.7 affected
1.31.0< 1.31.3 affected
1.25.0≤ 1.29.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-87858

Vulnerability Information

Shenlong is analyzing...

Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
Source: CVE Program / CVE List V5
Vulnerability Description
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving the caller's path, query, and request body. Where an internal frontend is deployed with its HTTP API enabled, that client resolves to the internal frontend, which authorizes every request as a system administrator without requiring authentication information. The result is that the server performs an attacker-chosen state-changing HTTP POST against its own administrative API on the caller's behalf, in namespaces where the caller has no permission. The caller never needs network access to the internal frontend, because the History service makes the request. Confirmed effects include terminating Workflows in other namespaces, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The affected routing logic is present in both the HSM and CHASM callback delivery implementations. This description and the CVSS score in this record describe releases 1.30.0 and later, where any non-empty source header is sufficient. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect in which the header must exactly match a configured cluster ID, a UUID that a namespace-scoped caller cannot read through the API. The consequence once that match occurs is the same, but the attack is materially harder and scores lower. To determine whether a deployment is affected, check two settings together: the static Server configuration for a non-zero services.internal-frontend.rpc.httpPort, and the effective per-namespace dynamic configuration value of component.callbacks.allowedAddresses. A deployment is exposed only when an internal frontend is deployed with a non-zero HTTP port, at least one allowlist rule admits a host, and authorization is enabled. The allowlist is empty by default, which denies all external callback URLs, and the stock static topology does not include an internal frontend. Note that a failed attach returns the error 'invalid url: url does not match any configured callback address', which proves only that one tested URL did not match and does not prove the effective allowlist is empty. To look for callbacks already attached, use DescribeWorkflowExecution, which returns callback information for a Workflow's registered completion callbacks. Operators should be aware of a gap when searching for evidence of delivery: the frontend HTTP API server records the request method and URL at debug level only, so at default log levels a delivered request is not written to the internal frontend's logs, and the absence of such log entries is not evidence that the issue was not exploited.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在安全决策中依赖未经信任的输入
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Temporal Technologies, Inc. Temporal Server 1.30.0 ~ 1.30.7 cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*
Temporal Technologies, Inc. Temporal Server 1.25.0 ~ 1.29.7 cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-87858

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-87858

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-87858 (3)

Other References for CVE-2026-87858 (3)

Same Patch Batch · Temporal Technologies, Inc. · 2026-09-21 · 8 CVEs total

CVE-2026-89139 8.7 HIGH Temporal Server worker deployment compute provider executes a caller-supplied command on t
CVE-2026-65653 8.7 HIGH temporalio/tchannel-go zero-chunk call fragment causes process termination
CVE-2026-65654 8.7 HIGH temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossi
CVE-2026-65652 8.7 HIGH temporalio/tchannel-go malformed checksum type causes process termination
CVE-2026-16652 7.1 HIGH Temporal Server Schedule exclusion search can cause excessive CPU consumption
CVE-2026-16651 7.1 HIGH temporalio/sqlparser malformed MySQL version comments can cause a panic
CVE-2026-65651 6.0 MEDIUM temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow duri

IV. Related Vulnerabilities

Same product: Temporal Server
Same vendor: Temporal Technologies, Inc.
Same weakness: CWE-807

V. Comments for CVE-2026-87858

No comments yet

Leave a comment