# go.temporal.io/server (Go) vulnerabilities 13 known vulnerabilities (6 high, 4 medium, 3 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: v1.32.2 (Oct 31, 2026): no advisory affects it - Newest unaffected release: v1.32.2 (Oct 31, 2026), the latest release - Releases: 500+ since v1.23.1 (Apr 30, 2024) - Registry: https://pkg.go.dev/go.temporal.io/server - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-120091: v1.31.0 to v1.31.4 (v1.31.5 is outside it); v1.32.0 to v1.32.1 (v1.32.2 is outside it) - CVE-2026-89139: v1.31.0 to v1.31.2 (v1.31.3 is outside it) - CVE-2026-87858: v1.25.0 to v1.29.7 (v1.30.0-143.0 is outside it); v1.30.0 to v1.30.6 (v1.30.7 is outside it); v1.31.0 to v1.31.2 (v1.31.3 is outside it) - CVE-2026-65651: v1.23.1 to v1.29.7 (v1.30.0-143.0 is outside it); v1.30.0 to v1.30.6 (v1.30.7 is outside it); v1.31.0 to v1.31.2 (v1.31.3 is outside it) - CVE-2026-16651: v1.29.0 to v1.29.7 (v1.30.0-143.0 is outside it); v1.30.0 to v1.30.6 (v1.30.7 is outside it); v1.31.0 to v1.31.2 (v1.31.3 is outside it) - CVE-2026-16652: v1.23.1 to v1.29.7 (v1.30.0-143.0 is outside it); v1.30.0 to v1.30.6 (v1.30.7 is outside it); v1.31.0 to v1.31.2 (v1.31.3 is outside it) - CVE-2026-5724: v1.23.1 to v1.28.3 (v1.28.4 is outside it); v1.29.0-135.0 to v1.29.5 (v1.29.6 is outside it); v1.30.0-143.0 to v1.30.3 (v1.30.4 is outside it) - CVE-2026-5199: v1.23.1 to v1.29.4 (v1.29.5 is outside it); v1.30.0-143.0 to v1.30.2 (v1.30.3 is outside it) - CVE-2025-14986: v1.24.0 to v1.27.3 (v1.27.4 is outside it); v1.28.0 to v1.28.1 (v1.28.2 is outside it); v1.29.0 to v1.29.1 (v1.29.2 is outside it) - CVE-2025-14987: v1.23.1 to v1.27.3 (v1.27.4 is outside it); v1.28.0 to v1.28.1 (v1.28.2 is outside it); v1.29.0-135.0 (v1.29.0-135.1 is outside it); v1.29.0 to v1.29.1 (v1.29.2 is outside it) - CVE-2025-8396: v1.23.1 to v1.26.2 (v1.26.3 is outside it); v1.27.0-126.0 to v1.27.2 (v1.27.3 is outside it); v1.28.0-129.0 to v1.28.0 (v1.28.1 is outside it) - CVE-2024-2689: no published release is affected - CVE-2023-3485: no published release is affected Older releases aren't stored, so the earliest spans may start sooner. ## Advisories (13) ### [CVE-2026-120091](https://cve.now/CVE-2026-120091): Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the… - Severity: High 8.7 - Published: Nov 2, 2026 - Affected: from 1.31.0, fixed in 1.31.5; from 1.32.0, fixed in 1.32.2. - Fixed in v1.31.5 (released Oct 31, 2026, 2 days before disclosure) and v1.32.2 (released Oct 31, 2026, 2 days before disclosure). - The latest release, v1.32.2, is not affected. ### [CVE-2026-89139](https://cve.now/CVE-2026-89139): Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host - Severity: High 8.7 - Published: Sep 21, 2026 - Affected: from 1.31.0, fixed in 1.31.3. - Fixed in v1.31.3 (released Sep 14, 2026, 7 days before disclosure). - The latest release, v1.32.2, is not affected. ### [CVE-2026-87858](https://cve.now/CVE-2026-87858): Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator… - Severity: High 7.2 - Published: Sep 21, 2026 - Affected: from 1.30.0, fixed in 1.30.7; from 1.31.0, fixed in 1.31.3; from 1.25.0, through 1.29.7. - Fixed in v1.30.7 (released Sep 15, 2026, 6 days before disclosure) and v1.31.3 (released Sep 14, 2026, 7 days before disclosure). - The latest release, v1.32.2, is not affected. ### [CVE-2026-65651](https://cve.now/CVE-2026-65651): temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal - Severity: High 8.7 - Published: Sep 21, 2026 - Affected: from 0.10.0, through 1.29.7; from 1.30.0, fixed in 1.30.7; from 1.31.0, fixed in 1.31.3. - Fixed in v1.30.7 (released Sep 15, 2026, 6 days before disclosure) and v1.31.3 (released Sep 14, 2026, 7 days before disclosure). - The latest release, v1.32.2, is not affected. ### [CVE-2026-16651](https://cve.now/CVE-2026-16651): temporalio/sqlparser malformed MySQL version comments can cause a panic - Severity: High 8.7 - Published: Sep 21, 2026 - Affected: from 1.29.0, through 1.29.7; from 1.30.0, fixed in 1.30.7; from 1.31.0, fixed in 1.31.3. - Fixed in v1.30.7 (released Sep 15, 2026, 6 days before disclosure) and v1.31.3 (released Sep 14, 2026, 7 days before disclosure). - The latest release, v1.32.2, is not affected. ### [CVE-2026-16652](https://cve.now/CVE-2026-16652): Temporal Server Schedule exclusion search can cause excessive CPU consumption - Severity: High 7.1 - Published: Sep 21, 2026 - Affected: from 1.17.0, through 1.29.7; from 1.30.0, fixed in 1.30.7; from 1.31.0, fixed in 1.31.3. - Fixed in v1.30.7 (released Sep 15, 2026, 6 days before disclosure) and v1.31.3 (released Sep 14, 2026, 7 days before disclosure). - The latest release, v1.32.2, is not affected. ### [CVE-2026-5724](https://cve.now/CVE-2026-5724): Missing Authentication on Streaming gRPC Replication Endpoint - Severity: Medium 6.3 - Published: Apr 10, 2026 - Affected: fixed in 1.28.4; from 1.29.0-135.0, fixed in 1.29.6; from 1.30.0-143.0, fixed in 1.30.4; fixed in 1.28.4; from 1.29.0-135.0, fixed in 1.29.6; from 1.30.0-143.0, fixed in 1.30.4. - Fixed in v1.28.4 (released Apr 8, 2026, 2 days before disclosure), v1.29.6 (released Apr 8, 2026, 2 days before disclosure) and v1.30.4 (released Apr 8, 2026, 2 days before disclosure). - The latest release, v1.32.2, is not affected. ### [CVE-2026-5199](https://cve.now/CVE-2026-5199): Cross Namespace Access via Batch Operation - Severity: Low 2.3 - Published: Apr 1, 2026 - Affected: fixed in 1.29.5; from 1.30.0-143.0, fixed in 1.30.3; from 1.30.0-143.0, fixed in 1.30.3; fixed in 1.29.5. - Fixed in v1.29.5 (released Mar 31, 2026, 1 day before disclosure) and v1.30.3 (released Mar 31, 2026, 1 day before disclosure). - The latest release, v1.32.2, is not affected. ### [CVE-2025-14986](https://cve.now/CVE-2025-14986): ExecuteMultiOperation Namespace Policy Bypass - Severity: Low 1.3 - Published: Dec 30, 2025 - Affected: from 1.24.0, fixed in 1.27.4; from 1.28.0, fixed in 1.28.2; from 1.29.0, fixed in 1.29.2; from 1.24.0, fixed in 1.27.4; from 1.28.0, fixed in 1.28.2; from 1.29.0, fixed in 1.29.2. - Fixed in v1.27.4 (released Dec 19, 2025, 11 days before disclosure), v1.28.2 (released Dec 19, 2025, 11 days before disclosure) and v1.29.2 (released Dec 18, 2025, 12 days before disclosure). - The latest release, v1.32.2, is not affected. ### [CVE-2025-14987](https://cve.now/CVE-2025-14987): Cross Namespace Commands Authorization Bypass - Severity: Medium 5.3 - Published: Dec 30, 2025 - Affected: fixed in 1.27.4; from 1.28.0, fixed in 1.28.2; from 1.29.0, fixed in 1.29.2; fixed in 1.27.4; from 1.28.0, fixed in 1.28.2; from 1.29.0, fixed in 1.29.2; from 1.29.0-0, fixed in 1.29.0-135.0.0.20251218190115-b292a32bacdf. - Fixed in v1.27.4 (released Dec 19, 2025, 11 days before disclosure), v1.28.2 (released Dec 19, 2025, 11 days before disclosure) and v1.29.2 (released Dec 18, 2025, 12 days before disclosure, the advisory names 1.29.0-135.0.0.20251218190115-b292a32bacdf, which was never published). - The latest release, v1.32.2, is not affected. ### [CVE-2025-8396](https://cve.now/CVE-2025-8396): Insufficiently specific bounds checking on authorization header could lead to denial of service in the Temporal server on all platforms… - Severity: Medium 6.9 - Published: Sep 15, 2025 - Affected: fixed in 1.26.3; from 1.27.0-126.0, fixed in 1.27.3; from 1.28.0-129.0, fixed in 1.28.1; fixed in 1.26.3; from 1.27.0-126.0, fixed in 1.27.3; from 1.28.0-129.0, fixed in 1.28.1. - Fixed in v1.26.3 (released Aug 20, 2025, 26 days before disclosure), v1.27.3 (released Aug 20, 2025, 26 days before disclosure) and v1.28.1 (released Aug 6, 2025, 40 days before disclosure). - The latest release, v1.32.2, is not affected. ### [CVE-2024-2689](https://cve.now/CVE-2024-2689): Denial of Service if invalid UTF-8 sent - Severity: Medium 4.4 - Published: Apr 3, 2024 - Affected: fixed in 1.20.5; from 1.21.0, fixed in 1.21.6; from 1.22.0-rc1, fixed in 1.22.7. - Fixed in 1.20.5, 1.21.6 and 1.22.7. - The latest release, v1.32.2, is not affected. ### [CVE-2023-3485](https://cve.now/CVE-2023-3485): Insecure Default Authorization in Temporal Server - Severity: Low 3.0 - Published: Jun 30, 2023 - Affected: fixed in 1.20.0. - Fixed in 1.20.0. - The latest release, v1.32.2, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/go/go.temporal.io/server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.