Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
Summary
| CVE | CVE-2026-87858 |
|---|---|
| State | PUBLISHED |
| Assigner | Temporal |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-09-21 12:17:22 UTC |
| Updated | 2026-09-21 16:17:25 UTC |
| Description | Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving the caller's path, query, and request body. Where an internal frontend is deployed with its HTTP API enabled, that client resolves to the internal frontend, which authorizes every request as a system administrator without requiring authentication information. The result is that the server performs an attacker-chosen state-changing HTTP POST against its own administrative API on the caller's behalf, in namespaces where the caller has no permission. The caller never needs network access to the internal frontend, because the History service makes the request. Confirmed effects include terminating Workflows in other namespaces, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The affected routing logic is present in both the HSM and CHASM callback delivery implementations. This description and the CVSS score in this record describe releases 1.30.0 and later, where any non-empty source header is sufficient. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect in which the header must exactly match a configured cluster ID, a UUID that a namespace-scoped caller cannot read through the API. The consequence once that match occurs is the same, but the attack is materially harder and scores lower. To determine whether a deployment is affected, check two settings together: the static Server configuration for a non-zero services.internal-frontend.rpc.httpPort, and the effective per-namespace dynamic configuration value of component.callbacks.allowedAddresses. A deployment is exposed only when an internal frontend is deployed with a non-zero HTTP port, at least one allowlist rule admits a host, and authorization is enabled. The allowlist is empty by default, which denies all external callback URLs, and the stock static topology does not include an internal frontend. Note that a failed attach returns the error 'invalid url: url does not match any configured callback address', which proves only that one tested URL did not match and does not prove the effective allowlist is empty. To look for callbacks already attached, use DescribeWorkflowExecution, which returns callback information for a Workflow's registered completion callbacks. Operators should be aware of a gap when searching for evidence of delivery: the frontend HTTP API server records the request method and URL at debug level only, so at default log levels a delivered request is not written to the internal frontend's logs, and the absence of such log entries is not evidence that the issue was not exploited. |
Risk And Classification
Primary CVSS: v4.0 7.2 HIGH from [email protected]
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Problem Types: CWE-807 | CWE-807 CWE-807: Reliance on Untrusted Inputs in a Security Decision
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 7.2 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 7.2 | HIGH | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Temporal Technologies Inc. | Temporal Server | affected 1.30.0 1.30.7 semver | Not specified |
| CNA | Temporal Technologies Inc. | Temporal Server | affected 1.31.0 1.31.3 semver | Not specified |
| CNA | Temporal Technologies Inc. | Temporal Server | affected 1.25.0 1.29.7 semver | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/temporalio/temporal/releases/tag/v1.31.3 | [email protected] | github.com | |
| github.com/temporalio/temporal/pull/11965 | [email protected] | github.com | |
| github.com/temporalio/temporal/pull/11982 | [email protected] | github.com | |
| github.com/temporalio/temporal/pull/12085 | [email protected] | github.com | |
| github.com/temporalio/temporal/releases/tag/v1.32.0 | [email protected] | github.com | |
| github.com/temporalio/temporal/releases/tag/v1.30.7 | [email protected] | github.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: An external security researcher who reported this issue responsibly to Temporal Technologies (en)
Additional Advisory Data
Solutions
CNA: Upgrade to Temporal Server 1.32.0, which ships callback.inspectSourceHeader set to false and needs no further change. The fix makes the completion-callback source header opt-in behind the callback.inspectSourceHeader setting, so a callback's internality is decided from the server-generated callback URL rather than from a caller-supplied header. Releases 1.30.7 and 1.31.3 carry the same code but ship callback.inspectSourceHeader set to true for mixed-version compatibility while callbacks created with the older callback URL template drain, and while it is true the routing behavior matches the affected releases; an operator upgrading within the 1.30 or 1.31 line must therefore also set callback.inspectSourceHeader to false once every pre-fix server has drained. Operators who set callback.inspectSourceHeader to true restore the pre-fix behavior in full, including preservation of the caller's path and query across the internal rewrite, and should not enable it on a cluster that accepts caller-supplied completion callbacks. Temporal Server releases in the 1.25.0 through 1.29.7 range are outside the supported window and receive no fix; operators on those releases should upgrade to a supported line.
Workarounds
CNA: Until a fixed release is available, a cluster that does not accept externally addressed Workflow completion callbacks can set the effective component.callbacks.allowedAddresses dynamic configuration value to an empty list, and remove or empty any more specific namespace-constrained entries that admit a host. Verify the effective value for every namespace in scope. An absent key already has the same deny-all default, but an explicit empty value is easier to audit. This rejects external http and https callback URLs at StartWorkflowExecution, before persistence and before either delivery implementation runs. It is a targeted mitigation rather than a way to disable Nexus: the reserved internal forms temporal://system and temporal://internal remain admitted, and there is no supported cluster-wide setting that turns Nexus off. As a separate defense in depth, operators that do not need the internal frontend's HTTP API can remove that service or set services.internal-frontend.rpc.httpPort to zero after confirming no internal consumers depend on it; this closes the administrative amplifier but does not correct the routing defect itself. Restricting or removing Nexus endpoints is not sufficient, because attaching the affected completion callback does not require a registered Nexus endpoint.