CVE-2026-96770— s2s-proxy accepts untrusted client certificates
Quick assessment
Affected
Temporal Technologies, Inc. s2s-proxy
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but do
Possible ATT&CK Techniques 1 AI
T1557 · Adversary-in-the-MiddleAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Temporal Technologies, Inc. | s2s-proxy | 0.0.1-alpha≤ 0.2.2 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96770
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
s2s-proxy accepts untrusted client certificates
Source: CVE Program / CVE List V5
Vulnerability Description
All published s2s-proxy versions through 0.2.2 are affected. In versions 0.1.16 through 0.2.2, TLS server listeners use Go's RequireAnyClientCert mode when skipCAVerification is false. This mode checks that the client holds the certificate's private key but does not verify the certificate against the configured CA. An attacker can therefore use a self-signed certificate and key to establish a TLS and yamux connection, then invoke RPCs allowed by the proxy's configuration and Temporal credentials. No certificate or private key trusted by the deployment, and no Temporal credential, is required.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:H/SI:H/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
证书信任链回溯不恰当
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Temporal Technologies, Inc. | s2s-proxy | 0.0.1-alpha ~ 0.2.2 | - |
|
II. Public POCs for CVE-2026-96770
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96770
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-96770 (3)
Other References for CVE-2026-96770 (1)
Other References for CVE-2026-96770 (1)
IV. Related Vulnerabilities
Same vendor: Temporal Technologies, Inc.
-
CVE-2026-89139
Temporal Server worker deployment compute provider executes -
CVE-2026-87858
Temporal Server completion callback source header can direct -
CVE-2026-65654
temporalio/ringpop-go fails to enforce configured label limi -
CVE-2026-65653
temporalio/tchannel-go zero-chunk call fragment causes proce -
CVE-2026-65652
temporalio/tchannel-go malformed checksum type causes proces
Same weakness: CWE-296
-
CVE-2026-73542
Seiko Epson Printer 加密问题漏洞 -
CVE-2026-24066
Slate Digital Connect macOS XPC certificate validation privi -
CVE-2026-33779
Junos OS: SRX Series: Insufficient certificate verification -
CVE-2025-48057
Icinga 2 certificate renewal might incorrectly renew an inva -
CVE-2025-22459
Ivanti Endpoint Manager 安全漏洞
V. Comments for CVE-2026-96770
No comments yet