Threats tagged 'ghsa-r7j7-m32j-h8w5'

Temporal Server versions 1.31.0 through 1.31.2 include a Worker Controller Instance module with a Kubernetes compute provider (k8s) that uses client configuration from the caller's request. This allows an authenticated user with only read access in a namespace to execute arbitrary commands on the Worker Service host, potentially impacting the entire Kubernetes cluster. The vulnerability arises because the default configuration in these versions permits the k8s provider without restriction. Later versions (1.31.3 and above) deny this by default unless explicitly enabled. The 1.30 release line is unaffected as it lacks this module.