CVE-2025-14986

EPSS 0.02%

Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts

發布日:2025/12/30修改日:2026/2/4

描述

When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.

受影響套件(2)

Go/go.temporal.io/server>= 1.24.0, < 1.27.4
Go/go.temporal.io/server>= 1.24.0, < 1.27.4, >= 1.28.0, < 1.28.2, >= 1.29.0, < 1.29.2

CVSS 分數

來源	版本	嚴重程度	向量
osv	CVSS 4.0	—	CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U

描述

受影響套件(2)

CVSS 分數

參考連結(7)