Threats Tagged 'cve-2026-89140'

Temporal Server versions 1.30.0 through 1.30.7, 1.31.0 through 1.31.3, and 1.32.0 are affected by an authorization bypass vulnerability. This flaw allows an authenticated user with write permission in one namespace to manipulate Scheduler V2 schedule state in another namespace by exploiting unbound internal completion callbacks. The issue arises because the reserved callback address temporal://internal is exempt from address allowlisting and lacks proper authorization checks across namespaces. Exploitation can cause schedule actions to be falsely marked as completed or schedules to be paused improperly, potentially disrupting workflow execution. No workflow payload or history disclosure is reported. Scheduler V2 is off by default, limiting the attack surface to namespaces with active Scheduler V2 schedules.