Temporal Discloses Eight Authorization and Availability Flaws

Quick Answer

Temporal disclosed eight issues spanning Server authorization and denial of service in Server or its SQL, TChannel, and Ringpop dependencies. The most consequential boundaries are namespace write access reaching administrative callbacks or Worker Service host commands under specific configurations. Other issues can terminate processes or exhaust CPU, memory, or gossip bandwidth. Check each CVE's version and prerequisites separately before selecting the Server or library fix.

Last verified: 2026-09-21 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.

Scope And Authority

Product scope	Temporal Server 1.29.7 and earlier and affected 1.30/1.31 branches, plus the listed sqlparser, tchannel-go, and ringpop-go dependency ranges
Advisory	CVE-2026-16651 / CVE-2026-16652 / CVE-2026-65651 / CVE-2026-65652 / CVE-2026-65653 / CVE-2026-65654 / CVE-2026-87858 / CVE-2026-89139
CVEs	CVE-2026-16651, CVE-2026-16652, CVE-2026-65651, CVE-2026-65652, CVE-2026-65653, CVE-2026-65654, CVE-2026-87858, CVE-2026-89139
Earliest listed CVE record publication	2026-09-21 11:23:47.298 UTC
Recorded CVE revision (historical snapshot)	2026-09-21 15:33:15.387 UTC
Affected versions	Temporal Server 1.29.7 and earlier and affected 1.30/1.31 branches, plus the listed sqlparser, tchannel-go, and ringpop-go dependency ranges
Fixed version	Temporal Server 1.30.7 / 1.31.3 / 1.32.0 as applicable by CVE; sqlparser v0.1.0; tchannel-go v1.22.1; ringpop-go v0.1.0. See the per-issue limits below.
CVSS base score	6.0 / 7.1 / 7.2 / 8.7 (CVSS v4.0)
CVSS severity	Medium to High
Exploitation status	Not stated by the authority; no exploitation claim is inferred.

What Changed

CVE-2026-16651: SQL Comment Panic

A malformed MySQL version comment can make Parse, ParseStrictDDL, or ParseNext panic because ExtractMysqlComment uses an unchecked search result as a slice boundary. A library caller can contain that panic only by recovering on the parsing goroutine. In Temporal Server, an enabled ListWorkers API lets an authenticated namespace reader terminate the receiving Matching process. Repetition can sustain denial of service; no confidentiality or integrity impact was identified.

CVE-2026-16652: Schedule CPU Exhaustion

A namespace writer can create a Schedule whose fine cadence and exclusions force an unbounded search for the next action time. Frontend and Schedule workers can consume excessive CPU. A persisted specification may keep its Schedule Workflow failing and retrying without further requests until the Schedule is deleted or its backing Workflow is terminated. Preserve the specification and follow an approved recovery decision before that destructive action. The reported impact is availability only, not disclosure or modification of Workflow data.

CVE-2026-65651: Fatal SQL Tree Traversal

Deeply nested unary SQL expressions can produce an abstract syntax tree that overflows the Go stack when String or Walk recursively traverses it. Unlike the comment panic, this runtime-fatal condition cannot be contained by Go panic recovery. Temporal archival, visibility, and worker-query validation paths can format attacker-controlled expressions while building errors. A namespace reader can terminate Frontend or Matching; the source-confirmed ListWorkers route additionally requires a retained worker heartbeat. This is an availability issue, and repeated requests can sustain it.

CVE-2026-65652 And 65653: TChannel Process Panics

These are two distinct tchannel-go parsing faults. An unsupported checksum-type value can index outside the checksum pool (65652); checksum metadata without argument chunks can leave an empty slice that the reader still indexes (65653). A peer needs access to the listener and must complete the ordinary initialization handshake; the zero-chunk case can occur in the initial call request. Unrecovered panics in library-created read or dispatch goroutines terminate the hosting process. Both affect availability only, with no identified confidentiality or integrity impact.

CVE-2026-65654: Ringpop Label Limits

A peer that reaches a live Ringpop TChannel listener can submit oversized label maps for distinct member addresses through SWIM membership changes. Local LabelOptions limits were not enforced on received labels. Accepted labels are retained and disseminated, consuming memory and gossip bandwidth beyond the intended bounds. The fix validates incoming labels before storage or propagation. The reported impact is availability only.

CVE-2026-87858: Callback Administrative Requests

An authenticated namespace writer can attach a callback with an allowed URL host and an attacker-chosen API path, query, body, and source header. In the affected HSM and CHASM delivery paths, History can retarget that request to the local internal frontend, which authorizes it as a system administrator. The caller does not need network access to that frontend. Reported effects include terminating Workflows across namespaces, creating namespaces, changing another namespace's configuration, and deleting a namespace and its Workflows.

Check authorization, a deployed internal frontend with nonzero services.internal-frontend.rpc.httpPort, and the effective per-namespace component.callbacks.allowedAddresses together. The callback allowlist is empty by default, and the stock topology has no internal frontend. In affected 1.30 and later releases, any nonempty source header is sufficient. In 1.25.0 through 1.29.7 it must match a configured cluster-ID UUID that a namespace-scoped caller cannot retrieve through the API; that older form is materially harder and scored lower, not unaffected.

An invalid url: url does not match any configured callback address error proves only that the tested URL was denied, not that the effective allowlist is empty. Use DescribeWorkflowExecution to inspect registered callbacks. The internal frontend records HTTP method and URL only at debug level, so missing delivery entries at default log levels do not exclude exploitation.

CVE-2026-89139: Worker Host Command Execution

In affected 1.31.0 through 1.31.2 releases, a namespace writer can configure the subprocess compute provider to run a caller-supplied program and arguments on the Worker Service host, under the server process account. An invoke-strategy provider runs immediately after specification validation; no scaling event or arriving task is needed. The service holds cluster-wide persistence credentials and TLS material, so consequences can cross namespace boundaries. Official binaries and images include the provider.

Assess the version, running Worker Service, real authorizer/claim mapper, and effective per-namespace workercontroller.compute_providers.enabled. An unset allowlist skips the check and permits registered providers; a list containing subprocess also leaves this path reachable. The Worker Service runs in the default service set. workercontroller.enabled=false does not gate this path; Temporal reports confirmation with that setting absent. Without an authorizer, callers already have unrestricted namespace access, so this specific authorization boundary does not exist. Inspect every namespace's worker deployment versions with DescribeWorkerDeploymentVersion and check scaling-group provider types. TechGeeks has not reproduced the command-execution path.

Match Server And Library Fixes Separately

The applicable Server fixes are 1.30.7 or 1.31.3; the two authorization records also reference 1.32.0. Do not interpret the combined table as an identical affected range for all eight CVEs. For standalone library consumers, the primary records identify sqlparser v0.1.0, tchannel-go v1.22.1, and ringpop-go v0.1.0 as fixed tags. The sqlparser fixes are commits 74181ffcbaaf and 0466b6b405ac; the Ringpop fix is c317effcdc8b. Verify the dependency actually built into the deployed artifact rather than substituting a Server version for a library fix.

What To Validate Now

1. Inventory. Locate Temporal Server 1.29.7 and earlier and affected 1.30/1.31 branches, plus the listed sqlparser, tchannel-go, and ringpop-go dependency ranges deployments, versions, enabled features, exposure paths, owners, and dependent services.
2. Establish applicability. Use each CVE's affected range and the effective namespace configuration. Callback routing, worker compute providers, enabled query routes, Schedule permissions, and reachable TChannel listeners are different exposure checks.
3. Remediate. Follow the applicable Server release or standalone dependency fix described below and the project's supported upgrade path. An old branch or embedded library needs its own verified migration decision, not an arbitrary choice from the combined version list.
4. Validate. Verify deployed artifacts, intended namespace authorization denials, callback routing, worker-provider policy, query handling, Schedule health, and member-service resource use. Run non-destructive representative workflows; do not invoke host commands or denial-of-service payloads in production.
5. Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.

Operational Cautions

Preserve configuration and evidence before removing callbacks, deleting Schedules, terminating Workflows, or changing worker deployments. Such recovery actions can disrupt legitimate work, and an update does not undo earlier cross-namespace actions or host-level access. Missing default-level HTTP logs and a single rejected callback are not evidence of safety.

Evidence To Retain

• Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
• UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
• Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.

Related TechGeeks Resources

• TechGeeks Security Notice Center
• All Security Notices

Authoritative References

• CVE-2026-16651
• CVE-2026-16652
• CVE-2026-65651
• CVE-2026-65652
• CVE-2026-65653
• CVE-2026-65654
• CVE-2026-87858
• CVE-2026-89139

Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.