https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-10T05:25:20.342026+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-iz19721 Withdrawn: CLEANSTART-2026-IZ19721 — Security fixes in temporal-server 1.31.1-r5 2026-10-10T05:25:20.363081+00:00

Withdrawn by the publisher.

Affected: CleanStart: temporal-server

Package temporal-server version 1.31.1-r5 fixes 9 vulnerabilities: ghsa-hrxh-6v49-42gf, CVE-2026-5724, ghsa-q98v-9f9w-f49q, ghsa-hmhp-gh8m-c8xp, ghsa-p2gr-hm8g-q772...

 https://cve.radiocsirt.org/vuln/cve-2025-14986 CVE-2025-14986 — ExecuteMultiOperation Namespace Policy Bypass 2026-10-10T05:25:20.363141+00:00

Affected: Temporal

When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.