CVE-2026-89139— Temporal Server Worker部署远程命令执行漏洞
一分钟漏洞结论
影响对象
Temporal Technologies, Inc. Temporal Server
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
Temporal Server 在其 Worker Service 中编译并包含了一个名为 Worker Controller Instance 的模块。该模块注册了一个名为 的计算提供者（compute provider），其功能是通过在托管 Worker Service 的机器上执行命令来启动一个 worker。该提供者在执行时所使用的程序名和参数向量，取自调用者在请求中提供的计算提供者配置，而非来自操作员（operator）的配置。 因此，一个仅拥有单个命名空间（namespace）写入权限（write ro
影响版本矩阵 1
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Temporal Technologies, Inc. | Temporal Server | 1.31.0< 1.31.3 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-89139 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
来源: CVE Program / CVE List V5
Vulnerability Description
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that provider executes are taken from the compute provider configuration supplied in the caller's request rather than from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore configure a worker deployment version so that the Worker Service executes a command of the caller's choosing on its own host, under the account the server process runs as. Execution is immediate rather than deferred: the configuration handler invokes every provider using the invoke strategy directly after validating the submitted specification, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The only control that can keep it unreachable is the compute provider allowlist, the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled, and that control does not deny by default: its default value is an unset list, and the allowlist check is skipped entirely when the value is unset, so every registered compute provider is permitted, this one included. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is 1.31.0 or later and earlier than 1.31.3. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective per-namespace value of workercontroller.compute_providers.enabled is either unset or contains subprocess. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Note that the separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path. It defaults to false, and a deployment that has never set it in any namespace is still affected, which was confirmed by running an affected release with no value for that setting present anywhere in dynamic configuration. To look for a compute configuration that is already attached, call DescribeWorkerDeploymentVersion for each worker deployment version in each namespace and check whether any scaling group's compute provider type is subprocess.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
来源: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Temporal Technologies, Inc. | Temporal Server | 1.31.0 ~ 1.31.3 |
cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*
|
|
二、漏洞 CVE-2026-89139 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-89139 的情报信息
请登录查看更多情报信息。
CVE-2026-89139 补丁与修复 (1)
CVE-2026-89139 其他参考 (2)
-
🔗 Release v1.32.0 · temporalio/temporal · GitHub release-notes
-
同批安全公告 · Temporal Technologies, Inc. · 2026-09-21 · 共 8 条
| CVE-2026-65653 | 8.7 HIGH | Tchannel-Go 零长度分片调用致进程终止 |
| CVE-2026-65654 | 8.7 HIGH | Ringpop-go 入站成员 gossip 未执行标签限制 |
| CVE-2026-65652 | 8.7 HIGH | tchannel-go 校验和类型错误导致进程终止漏洞 |
| CVE-2026-87858 | 7.2 HIGH | Temporal Server 管理权限劫持漏洞 |
| CVE-2026-16652 | 7.1 HIGH | Temporal Server 调度排除搜索致 CPU 高耗 |
| CVE-2026-16651 | 7.1 HIGH | Temporal sqlparser MySQL版本注释致Panic |
| CVE-2026-65651 | 6.0 MEDIUM | temporalio/sqlparser 深层嵌套表达式栈溢出漏洞 |