The vulnerability in s2s-proxy versions up to 0.2.2 involves improper validation of client TLS certificates. Specifically, when skipCAVerification is false, the TLS server listener uses Go's RequireAnyClientCert mode, which only verifies possession of the private key but does not validate the certificate against the trusted CA chain. This allows an attacker to present a self-signed certificate and key to establish a TLS and yamux connection and invoke RPCs permitted by the proxy's configuration and Temporal credentials, without requiring any trusted certificate or private key.

An attacker can bypass the certificate chain of trust and establish unauthorized TLS connections to the s2s-proxy, enabling invocation of RPCs that may lead to unauthorized access or actions within the Temporal environment. This occurs without needing any trusted certificate, private key, or Temporal credential, significantly compromising the security of affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, deployments should consider disabling or restricting the affected TLS server listener configurations or applying additional network-level controls to limit exposure.