The vulnerability CVE-2026-5724 arises from missing authentication enforcement on the streaming AdminService/StreamWorkflowReplicationMessages endpoint in Temporal's frontend gRPC server. While unary RPCs enforce authentication and authorization when ClaimMapper and Authorizer are configured, this streaming endpoint did not include the authorization interceptor in its interceptor chain. Since the endpoint shares the same port as WorkflowService and cannot be disabled independently, an attacker with network access to this port could open a replication stream without credentials. However, data exfiltration is constrained by the requirement that the replication target be properly configured and the attacker must know cluster configuration details because the history service validates cluster IDs and peer membership before returning replication data. The vulnerability is fixed in versions 1.28.4, 1.29.6, 1.30.4, 1.31.2, 1.32.0, and later. Temporal Cloud is not affected.

An attacker with network access to the frontend port can open an unauthenticated replication stream, potentially leading to data exfiltration. However, exploitation requires knowledge of cluster configuration and a correctly configured replication target. The history service performs validation of cluster IDs and peer membership, limiting unauthorized data access. Temporal Cloud services are not impacted by this vulnerability.

Fixes for this vulnerability have been applied in Temporal versions 1.28.4, 1.29.6, 1.30.4, 1.31.2, 1.32.0, and later. Versions 1.31.0 and 1.31.1 remain vulnerable and should be upgraded to a fixed release to mitigate the risk. Temporal Cloud is not affected and requires no action. Patch status is confirmed by vendor advisory information.