Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-89139— Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host

Quick assessment

Affected
Temporal Technologies, Inc. Temporal Server
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program

CVSS 8.7 · High EPSS 0.47% · P40

Affected Version Matrix 1

VendorProduct Version RangeStatus
Temporal Technologies, Inc. Temporal Server 1.31.0< 1.31.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-89139

Vulnerability Information

Shenlong is analyzing...

Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
Source: CVE Program / CVE List V5
Vulnerability Description
Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that provider executes are taken from the compute provider configuration supplied in the caller's request rather than from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore configure a worker deployment version so that the Worker Service executes a command of the caller's choosing on its own host, under the account the server process runs as. Execution is immediate rather than deferred: the configuration handler invokes every provider using the invoke strategy directly after validating the submitted specification, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The only control that can keep it unreachable is the compute provider allowlist, the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled, and that control does not deny by default: its default value is an unset list, and the allowlist check is skipped entirely when the value is unset, so every registered compute provider is permitted, this one included. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is 1.31.0 or later and earlier than 1.31.3. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective per-namespace value of workercontroller.compute_providers.enabled is either unset or contains subprocess. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Note that the separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path. It defaults to false, and a deployment that has never set it in any namespace is still affected, which was confirmed by running an affected release with no value for that setting present anywhere in dynamic configuration. To look for a compute configuration that is already attached, call DescribeWorkerDeploymentVersion for each worker deployment version in each namespace and check whether any scaling group's compute provider type is subprocess.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
OS命令中使用的特殊元素转义处理不恰当(OS命令注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Temporal Technologies, Inc. Temporal Server 1.31.0 ~ 1.31.3 cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-89139

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-89139

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-89139 (2)

Other References for CVE-2026-89139 (2)

Same Patch Batch · Temporal Technologies, Inc. · 2026-09-21 · 8 CVEs total

CVE-2026-65653 8.7 HIGH temporalio/tchannel-go zero-chunk call fragment causes process termination
CVE-2026-65654 8.7 HIGH temporalio/ringpop-go fails to enforce configured label limits on inbound membership gossi
CVE-2026-65652 8.7 HIGH temporalio/tchannel-go malformed checksum type causes process termination
CVE-2026-87858 7.2 HIGH Temporal Server completion callback source header can direct attacker-chosen requests to t
CVE-2026-16652 7.1 HIGH Temporal Server Schedule exclusion search can cause excessive CPU consumption
CVE-2026-16651 7.1 HIGH temporalio/sqlparser malformed MySQL version comments can cause a panic
CVE-2026-65651 6.0 MEDIUM temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow duri

IV. Related Vulnerabilities

Same product: Temporal Server
Same vendor: Temporal Technologies, Inc.
Same weakness: CWE-78

V. Comments for CVE-2026-89139

No comments yet

Leave a comment