https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 11:08:37 +0000 https://cve.radiocsirt.org/vuln/cleanstart-2026-cp63847 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: temporal-server</p> <p>Package temporal-server version 1.28.4-r1 fixes 15 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: temporal-server</p> <p>Package temporal-server version 1.28.4-r1 fixes 15 vulnerabilities: CVE-2026-39821, CVE-2026-33818, CVE-2026-46600, CVE-2026-56853, CVE-2026-56858...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-cp63847 https://cve.radiocsirt.org/vuln/euvd-2026-264769 EUVD-2026-264769 https://cve.radiocsirt.org/vuln/euvd-2026-264769 https://cve.radiocsirt.org/vuln/fkie_cve-2025-14986 <p>When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace&#39;s limits/policies by setting the embedded start request&#39;s namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.</p> <p>When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace&#39;s limits/policies by setting the embedded start request&#39;s namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-14986 https://cve.radiocsirt.org/vuln/ghsa-p2gr-hm8g-q772 <p><strong>Affected:</strong> Go: go.temporal.io/server</p> <p>When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace&#39;s limits/policies by setting the embedded start request&#39;s namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.</p> <p><strong>Affected:</strong> Go: go.temporal.io/server</p> <p>When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace&#39;s limits/policies by setting the embedded start request&#39;s namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.</p> https://cve.radiocsirt.org/vuln/ghsa-p2gr-hm8g-q772