Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces
Summary
| CVE | CVE-2026-104355 |
|---|---|
| State | PUBLISHED |
| Assigner | Temporal |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-10-12 19:16:36 UTC |
| Updated | 2026-10-12 19:16:36 UTC |
| Description | A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote clusters an administrator has registered with connection enabled; the sending side excludes local namespaces, but the receiving side does not apply the same rule. When an inbound task names an existing namespace, the server checks at most that the namespace identifiers match, then overwrites its state, description, owner, retention, archival settings, and cluster list, and its active cluster when the task carries a higher failover version, without checking that the namespace is global. A party that controls a registered peer's replies, by operating or compromising it, can therefore change any local namespace whose name and identifier it can supply, without any credential on the receiving cluster: for example, marking it Deprecated, making the peer its active cluster, and shortening its retention, after which new Workflow starts in that namespace fail. Local namespaces include the built-in temporal-system namespace. Namespace metadata the History service refreshes from the peer while processing its history replication tasks passes through the same logic. A cluster with no remote cluster registered with connection enabled is not exposed. |
Risk And Classification
Primary CVSS: v4.0 7 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-863 | CWE-863 CWE-863: Incorrect Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Temporal Technologies Inc. | Temporal Server | unknown 0.0.0 1.0.0 semver | Not specified |
| CNA | Temporal Technologies Inc. | Temporal Server | affected 1.0.0 1.29.7 semver | Not specified |
| CNA | Temporal Technologies Inc. | Temporal Server | affected 1.30.0 1.30.8 semver | Not specified |
| CNA | Temporal Technologies Inc. | Temporal Server | affected 1.31.0 1.31.4 semver | Not specified |
| CNA | Temporal Technologies Inc. | Temporal Server | affected 1.32.0 1.32.1 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/temporalio/temporal/pull/12323 | [email protected] | github.com | |
| github.com/temporalio/temporal/pull/12329 | [email protected] | github.com | |
| github.com/temporalio/temporal/blob/v1.0.0/common/namespace/replicationT... | [email protected] | github.com | |
| github.com/temporalio/temporal/pull/12330 | [email protected] | github.com | |
| github.com/temporalio/temporal/releases/tag/v1.32.1 | [email protected] | github.com | |
| github.com/temporalio/temporal/releases/tag/v1.30.8 | [email protected] | github.com | |
| github.com/temporalio/temporal/commit/f2b571e2eee8a9143fbc4711f3db8b5a37... | [email protected] | github.com | |
| github.com/temporalio/temporal/releases/tag/v1.31.4 | [email protected] | github.com | |
| github.com/temporalio/temporal/pull/12328 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Zellic, who reported this issue responsibly to Temporal Technologies (en)
CNA: V12 (en)
Additional Advisory Data
Solutions
CNA: Upgrade to Temporal Server 1.30.8, 1.31.4, or 1.32.1, as appropriate for the deployed minor release line, and keep the dynamic configuration setting history.validateReplicationTaskSourceCluster at its default of true. Fixed releases ignore an inbound namespace replication task, including one applied through the namespace metadata refresh that history replication can trigger, when it targets a namespace the receiving cluster stores as local, and ignore inbound task queue user data replication for a local namespace. With history.validateReplicationTaskSourceCluster enabled, fixed releases also ignore an inbound history replication task when the sending cluster is not in the namespace's cluster list, which for a local namespace is every remote cluster. The fix does not change how a connected peer can update a global namespace replicated with the receiving cluster. Fixed releases do not repair a local namespace that was already modified; review local namespaces, including temporal-system, as described in the workarounds. Temporal Server releases up to and including 1.29.7 are outside the supported window and receive no fix; operators on those releases should upgrade to a supported line.
Workarounds
CNA: Until upgrading, register a remote cluster, and keep its connection enabled, only when that cluster and everyone able to control it are trusted with administrative authority over every namespace on the receiving cluster, including its local namespaces and temporal-system. Disabling the connection to a remote cluster stops the receiving cluster from pulling replication tasks from it, and also stops legitimate replication of global namespaces with that cluster. Review local namespaces, including temporal-system, for a cluster list or active cluster other than the current cluster.