https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T06:36:32.613096+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-cp63847 Withdrawn: CLEANSTART-2026-CP63847 — Security fixes in temporal-server 1.28.4-r1 2026-10-04T06:36:32.688893+00:00

Withdrawn by the publisher.

Affected: CleanStart: temporal-server

Package temporal-server version 1.28.4-r1 fixes 15 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...

 https://cve.radiocsirt.org/vuln/euvd-2026-264769 EUVD-2026-264769 2026-10-04T06:36:32.688950+00:00 EUVD-2026-264769 https://cve.radiocsirt.org/vuln/fkie_cve-2025-14986 fkie_cve-2025-14986 2026-10-04T06:36:32.688967+00:00

When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.

 https://cve.radiocsirt.org/vuln/ghsa-p2gr-hm8g-q772 GHSA-p2gr-hm8g-q772 — Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts 2026-10-04T06:36:32.688995+00:00

Affected: Go: go.temporal.io/server

When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.