Skip to main content
cve.nowby Sazabi
← Go
GoPackage

go.temporal.io/server

13 known vulnerabilities (6 high, 4 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
v1.32.2 (Oct 31, 2026): no advisory affects it
Newest unaffected release
v1.32.2 (Oct 31, 2026), the latest release
Advisories
13 · 6 high, 4 medium, 3 low
Releases
500+ since v1.23.1 (Apr 30, 2024)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-120091
    Affects v1.31.0 to v1.31.4 (v1.31.5 is outside it); v1.32.0 to v1.32.1 (v1.32.2 is outside it)
  • CVE-2026-89139
    Affects v1.31.0 to v1.31.2 (v1.31.3 is outside it)
  • CVE-2026-87858
    Affects v1.25.0 to v1.29.7 (v1.30.0-143.0 is outside it); v1.30.0 to v1.30.6 (v1.30.7 is outside it); v1.31.0 to v1.31.2 (v1.31.3 is outside it)
  • CVE-2026-65651
    Affects v1.23.1 to v1.29.7 (v1.30.0-143.0 is outside it); v1.30.0 to v1.30.6 (v1.30.7 is outside it); v1.31.0 to v1.31.2 (v1.31.3 is outside it)
  • CVE-2026-16651
    Affects v1.29.0 to v1.29.7 (v1.30.0-143.0 is outside it); v1.30.0 to v1.30.6 (v1.30.7 is outside it); v1.31.0 to v1.31.2 (v1.31.3 is outside it)
  • CVE-2026-16652
    Affects v1.23.1 to v1.29.7 (v1.30.0-143.0 is outside it); v1.30.0 to v1.30.6 (v1.30.7 is outside it); v1.31.0 to v1.31.2 (v1.31.3 is outside it)
  • CVE-2026-5724
    Affects v1.23.1 to v1.28.3 (v1.28.4 is outside it); v1.29.0-135.0 to v1.29.5 (v1.29.6 is outside it); v1.30.0-143.0 to v1.30.3 (v1.30.4 is outside it)
  • CVE-2026-5199
    Affects v1.23.1 to v1.29.4 (v1.29.5 is outside it); v1.30.0-143.0 to v1.30.2 (v1.30.3 is outside it)
  • CVE-2025-14986
    Affects v1.24.0 to v1.27.3 (v1.27.4 is outside it); v1.28.0 to v1.28.1 (v1.28.2 is outside it); v1.29.0 to v1.29.1 (v1.29.2 is outside it)
  • CVE-2025-14987
    Affects v1.23.1 to v1.27.3 (v1.27.4 is outside it); v1.28.0 to v1.28.1 (v1.28.2 is outside it); v1.29.0-135.0 (v1.29.0-135.1 is outside it); v1.29.0 to v1.29.1 (v1.29.2 is outside it)
  • CVE-2025-8396
    Affects v1.23.1 to v1.26.2 (v1.26.3 is outside it); v1.27.0-126.0 to v1.27.2 (v1.27.3 is outside it); v1.28.0-129.0 to v1.28.0 (v1.28.1 is outside it)
  • CVE-2024-2689
    No published release is affected
    No published release is affected
  • CVE-2023-3485
    No published release is affected
    No published release is affected
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects. Older releases aren't stored, so the earliest spans may start sooner.

Advisories 13

  • Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the…

    Affected: from 1.31.0, fixed in 1.31.5; from 1.32.0, fixed in 1.32.2.

    Fixed in v1.31.5 (released Oct 31, 2026, 2 days before disclosure) and v1.32.2 (released Oct 31, 2026, 2 days before disclosure).

    The latest release, v1.32.2, is not affected.

  • Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host

    Affected: from 1.31.0, fixed in 1.31.3.

    Fixed in v1.31.3 (released Sep 14, 2026, 7 days before disclosure).

    The latest release, v1.32.2, is not affected.

  • Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator…

    Affected: from 1.30.0, fixed in 1.30.7; from 1.31.0, fixed in 1.31.3; from 1.25.0, through 1.29.7.

    Fixed in v1.30.7 (released Sep 15, 2026, 6 days before disclosure) and v1.31.3 (released Sep 14, 2026, 7 days before disclosure).

    The latest release, v1.32.2, is not affected.

  • temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal

    Affected: from 0.10.0, through 1.29.7; from 1.30.0, fixed in 1.30.7; from 1.31.0, fixed in 1.31.3.

    Fixed in v1.30.7 (released Sep 15, 2026, 6 days before disclosure) and v1.31.3 (released Sep 14, 2026, 7 days before disclosure).

    The latest release, v1.32.2, is not affected.

  • temporalio/sqlparser malformed MySQL version comments can cause a panic

    Affected: from 1.29.0, through 1.29.7; from 1.30.0, fixed in 1.30.7; from 1.31.0, fixed in 1.31.3.

    Fixed in v1.30.7 (released Sep 15, 2026, 6 days before disclosure) and v1.31.3 (released Sep 14, 2026, 7 days before disclosure).

    The latest release, v1.32.2, is not affected.

  • Temporal Server Schedule exclusion search can cause excessive CPU consumption

    Affected: from 1.17.0, through 1.29.7; from 1.30.0, fixed in 1.30.7; from 1.31.0, fixed in 1.31.3.

    Fixed in v1.30.7 (released Sep 15, 2026, 6 days before disclosure) and v1.31.3 (released Sep 14, 2026, 7 days before disclosure).

    The latest release, v1.32.2, is not affected.

  • CVE-2026-5724Medium 6.3

    Missing Authentication on Streaming gRPC Replication Endpoint

    Affected: fixed in 1.28.4; from 1.29.0-135.0, fixed in 1.29.6; from 1.30.0-143.0, fixed in 1.30.4; fixed in 1.28.4; from 1.29.0-135.0, fixed in 1.29.6; from 1.30.0-143.0, fixed in 1.30.4.

    Fixed in v1.28.4 (released Apr 8, 2026, 2 days before disclosure), v1.29.6 (released Apr 8, 2026, 2 days before disclosure) and v1.30.4 (released Apr 8, 2026, 2 days before disclosure).

    The latest release, v1.32.2, is not affected.

  • Cross Namespace Access via Batch Operation

    Affected: fixed in 1.29.5; from 1.30.0-143.0, fixed in 1.30.3; from 1.30.0-143.0, fixed in 1.30.3; fixed in 1.29.5.

    Fixed in v1.29.5 (released Mar 31, 2026, 1 day before disclosure) and v1.30.3 (released Mar 31, 2026, 1 day before disclosure).

    The latest release, v1.32.2, is not affected.

  • ExecuteMultiOperation Namespace Policy Bypass

    Affected: from 1.24.0, fixed in 1.27.4; from 1.28.0, fixed in 1.28.2; from 1.29.0, fixed in 1.29.2; from 1.24.0, fixed in 1.27.4; from 1.28.0, fixed in 1.28.2; from 1.29.0, fixed in 1.29.2.

    Fixed in v1.27.4 (released Dec 19, 2025, 11 days before disclosure), v1.28.2 (released Dec 19, 2025, 11 days before disclosure) and v1.29.2 (released Dec 18, 2025, 12 days before disclosure).

    The latest release, v1.32.2, is not affected.

  • CVE-2025-14987Medium 5.3

    Cross Namespace Commands Authorization Bypass

    Affected: fixed in 1.27.4; from 1.28.0, fixed in 1.28.2; from 1.29.0, fixed in 1.29.2; fixed in 1.27.4; from 1.28.0, fixed in 1.28.2; from 1.29.0, fixed in 1.29.2; from 1.29.0-0, fixed in 1.29.0-135.0.0.20251218190115-b292a32bacdf.

    Fixed in v1.27.4 (released Dec 19, 2025, 11 days before disclosure), v1.28.2 (released Dec 19, 2025, 11 days before disclosure) and v1.29.2 (released Dec 18, 2025, 12 days before disclosure, the advisory names 1.29.0-135.0.0.20251218190115-b292a32bacdf, which was never published).

    The latest release, v1.32.2, is not affected.

  • CVE-2025-8396Medium 6.9

    Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms…

    Affected: fixed in 1.26.3; from 1.27.0-126.0, fixed in 1.27.3; from 1.28.0-129.0, fixed in 1.28.1; fixed in 1.26.3; from 1.27.0-126.0, fixed in 1.27.3; from 1.28.0-129.0, fixed in 1.28.1.

    Fixed in v1.26.3 (released Aug 20, 2025, 26 days before disclosure), v1.27.3 (released Aug 20, 2025, 26 days before disclosure) and v1.28.1 (released Aug 6, 2025, 40 days before disclosure).

    The latest release, v1.32.2, is not affected.

  • CVE-2024-2689Medium 4.4

    Denial of Service if invalid UTF-8 sent

    Affected: fixed in 1.20.5; from 1.21.0, fixed in 1.21.6; from 1.22.0-rc1, fixed in 1.22.7.

    Fixed in 1.20.5, 1.21.6 and 1.22.7.

    The latest release, v1.32.2, is not affected.

  • Insecure Default Authorization in Temporal Server

    Affected: fixed in 1.20.0.

    Fixed in 1.20.0.

    The latest release, v1.32.2, is not affected.