CVE-2026-108126: CWE-639: Authorization Bypass Through User-Controlled Key in Temporal Technologies, Inc. temporal-proxy

The temporal-proxy component in versions 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace for which they were encrypted. When encryption is enabled, the proxy selects the decryption key based on an identifier stored within the payload rather than the namespace of the request. Consequently, a caller authorized only for namespace B can decrypt payloads from namespace A if they have obtained those payloads. In version 0.8.0, the caller can also submit such payloads to the codec server's /decode endpoint. Additionally, if the caller can write to namespace B on the Temporal server, they can place the payload there and read it back through the proxy. This vulnerability exists regardless of whether namespaces share a default key or have separate keys because the proxy holds all configured keys. The vulnerability does not enable attackers to obtain encrypted payloads they could not already access, nor does it allow modification of encrypted payloads.

An attacker authorized for one namespace can decrypt encrypted payloads from another namespace by exploiting the proxy's use of a user-controlled key identifier rather than the request namespace for decryption. This bypasses intended authorization boundaries between namespaces. However, the attacker cannot obtain encrypted payloads they do not already have access to, nor can they modify encrypted payloads. The vulnerability could lead to unauthorized disclosure of encrypted data across namespaces within the same proxy environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to namespaces carefully and monitor for unauthorized cross-namespace access. Avoid enabling payload encryption in environments where strict namespace isolation is required unless mitigations are in place.