https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 01:08:04 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-cp63847 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: temporal-server</p> <p>Package temporal-server version 1.28.4-r1 fixes 15 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: temporal-server</p> <p>Package temporal-server version 1.28.4-r1 fixes 15 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-cp63847 https://cve.radiocsirt.org/vuln/euvd-2026-264767 EUVD-2026-264767 https://cve.radiocsirt.org/vuln/euvd-2026-264767 https://cve.radiocsirt.org/vuln/fkie_cve-2025-14987 <p>When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace. This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.</p> <p>When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace. This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-14987 https://cve.radiocsirt.org/vuln/ghsa-hmhp-gh8m-c8xp <p><strong>Affected:</strong> Go: go.temporal.io/server</p> <p>When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace. This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.</p> <p><strong>Affected:</strong> Go: go.temporal.io/server</p> <p>When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace. This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.</p> https://cve.radiocsirt.org/vuln/ghsa-hmhp-gh8m-c8xp