Vulnerability-Lookup

GHSA-W8CX-4CF2-9HVR

Vulnerability from github – Published: 2026-09-21 12:32 – Updated: 2026-09-21 12:32

Details

Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that provider executes are taken from the compute provider configuration supplied in the caller's request rather than from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore configure a worker deployment version so that the Worker Service executes a command of the caller's choosing on its own host, under the account the server process runs as. Execution is immediate rather than deferred: the configuration handler invokes every provider using the invoke strategy directly after validating the submitted specification, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The only control that can keep it unreachable is the compute provider allowlist, the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled, and that control does not deny by default: its default value is an unset list, and the allowlist check is skipped entirely when the value is unset, so every registered compute provider is permitted, this one included. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is 1.31.0 or later and earlier than 1.31.3. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective per-namespace value of workercontroller.compute_providers.enabled is either unset or contains subprocess. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Note that the separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path. It defaults to false, and a deployment that has never set it in any namespace is still affected, which was confirmed by running an affected release with no value for that setting present anywhere in dynamic configuration. To look for a compute configuration that is already attached, call DescribeWorkerDeploymentVersion for each worker deployment version in each namespace and check whether any scaling group's compute provider type is subprocess.

Severity

8.7 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-89139"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-21T12:17:24Z",
    "severity": "HIGH"
  },
  "details": "Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that provider executes are taken from the compute provider configuration supplied in the caller\u0027s request rather than from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore configure a worker deployment version so that the Worker Service executes a command of the caller\u0027s choosing on its own host, under the account the server process runs as. Execution is immediate rather than deferred: the configuration handler invokes every provider using the invoke strategy directly after validating the submitted specification, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster\u0027s TLS material, the consequence reaches beyond the caller\u0027s namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The only control that can keep it unreachable is the compute provider allowlist, the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled, and that control does not deny by default: its default value is an unset list, and the allowlist check is skipped entirely when the value is unset, so every registered compute provider is permitted, this one included. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is 1.31.0 or later and earlier than 1.31.3. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective per-namespace value of workercontroller.compute_providers.enabled is either unset or contains subprocess. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Note that the separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path. It defaults to false, and a deployment that has never set it in any namespace is still affected, which was confirmed by running an affected release with no value for that setting present anywhere in dynamic configuration. To look for a compute configuration that is already attached, call DescribeWorkerDeploymentVersion for each worker deployment version in each namespace and check whether any scaling group\u0027s compute provider type is subprocess.",
  "id": "GHSA-w8cx-4cf2-9hvr",
  "modified": "2026-09-21T12:32:39Z",
  "published": "2026-09-21T12:32:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-89139"
    },
    {
      "type": "WEB",
      "url": "https://github.com/temporalio/temporal-auto-scaled-workers/pull/129"
    },
    {
      "type": "WEB",
      "url": "https://github.com/temporalio/temporal/pull/12021"
    },
    {
      "type": "WEB",
      "url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/temporalio/temporal/releases/tag/v1.32.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

CVE-2026-89139 (GCVE-0-2026-89139)

Vulnerability from cvelistv5 – Published: 2026-09-21 11:41 – Updated: 2026-09-21 15:24

Title

Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host

Summary

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-21 15:24 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-749 - Exposed Dangerous Method or Function
CWE-1188 - Initialization of a Resource with an Insecure Default

Assigner

Temporal mitre root

References

4 references

URL	Tags
https://github.com/temporalio/temporal/releases/t…	release-notes
https://github.com/temporalio/temporal/releases/t…	release-notes
https://github.com/temporalio/temporal-auto-scale…	patch
https://github.com/temporalio/temporal/pull/12021	patch

Impacted products

1 product

Vendor	Product	Version
Temporal Technologies, Inc.	Temporal Server	Affected: 1.31.0 , < 1.31.3 (semver) cpe:2.3:a:temporal:temporal::::::::

Credits

Reported internally at Temporal Technologies, Inc.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-89139",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:24:29.098568Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:24:46.549Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "cpes": [
            "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "packageName": "go.temporal.io/server",
          "product": "Temporal Server",
          "repo": "https://github.com/temporalio/temporal",
          "vendor": "Temporal Technologies, Inc.",
          "versions": [
            {
              "lessThan": "1.31.3",
              "status": "affected",
              "version": "1.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eExploitation requires all of the following at once. The deployment runs an affected Temporal Server release with the Worker Service enabled, which is the default service set, so a stock deployment satisfies this. Authorization is configured through an authorizer and a claim mapper; without it every caller already holds unrestricted access to every namespace and there is no namespace boundary to cross. The caller holds a write role in some namespace, which is what the frontend requires to create a worker deployment version or to update a worker deployment version\u0027s compute configuration. A worker deployment is already registered in that namespace, because the create call updates an existing worker deployment rather than starting one; registering a worker deployment requires the same namespace write role the rest of the path already requires, so this adds a step without raising the privilege needed. No feature flag has to be enabled by the operator: system.enableDeploymentVersions defaults to true, the per-namespace Worker Controller component is enabled unconditionally, and the compute provider allowlist defaults to permitting every registered provider. The provider wraps the command it runs in the timeout utility, which must resolve on the host\u0027s PATH; the base image used for the official container images supplies it.\u003c/p\u003e"
            }
          ],
          "value": "Exploitation requires all of the following at once. The deployment runs an affected Temporal Server release with the Worker Service enabled, which is the default service set, so a stock deployment satisfies this. Authorization is configured through an authorizer and a claim mapper; without it every caller already holds unrestricted access to every namespace and there is no namespace boundary to cross. The caller holds a write role in some namespace, which is what the frontend requires to create a worker deployment version or to update a worker deployment version\u0027s compute configuration. A worker deployment is already registered in that namespace, because the create call updates an existing worker deployment rather than starting one; registering a worker deployment requires the same namespace write role the rest of the path already requires, so this adds a step without raising the privilege needed. No feature flag has to be enabled by the operator: system.enableDeploymentVersions defaults to true, the per-namespace Worker Controller component is enabled unconditionally, and the compute provider allowlist defaults to permitting every registered provider. The provider wraps the command it runs in the timeout utility, which must resolve on the host\u0027s PATH; the base image used for the official container images supplies it."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Reported internally at Temporal Technologies, Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTemporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that provider executes are taken from the compute provider configuration supplied in the caller\u0027s request rather than from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore configure a worker deployment version so that the Worker Service executes a command of the caller\u0027s choosing on its own host, under the account the server process runs as. Execution is immediate rather than deferred: the configuration handler invokes every provider using the invoke strategy directly after validating the submitted specification, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster\u0027s TLS material, the consequence reaches beyond the caller\u0027s namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The only control that can keep it unreachable is the compute provider allowlist, the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled, and that control does not deny by default: its default value is an unset list, and the allowlist check is skipped entirely when the value is unset, so every registered compute provider is permitted, this one included. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is 1.31.0 or later and earlier than 1.31.3. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective per-namespace value of workercontroller.compute_providers.enabled is either unset or contains subprocess. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Note that the separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path. It defaults to false, and a deployment that has never set it in any namespace is still affected, which was confirmed by running an affected release with no value for that setting present anywhere in dynamic configuration. To look for a compute configuration that is already attached, call DescribeWorkerDeploymentVersion for each worker deployment version in each namespace and check whether any scaling group\u0027s compute provider type is subprocess.\u003c/p\u003e"
            }
          ],
          "value": "Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that provider executes are taken from the compute provider configuration supplied in the caller\u0027s request rather than from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore configure a worker deployment version so that the Worker Service executes a command of the caller\u0027s choosing on its own host, under the account the server process runs as. Execution is immediate rather than deferred: the configuration handler invokes every provider using the invoke strategy directly after validating the submitted specification, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster\u0027s TLS material, the consequence reaches beyond the caller\u0027s namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The only control that can keep it unreachable is the compute provider allowlist, the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled, and that control does not deny by default: its default value is an unset list, and the allowlist check is skipped entirely when the value is unset, so every registered compute provider is permitted, this one included. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is 1.31.0 or later and earlier than 1.31.3. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective per-namespace value of workercontroller.compute_providers.enabled is either unset or contains subprocess. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Note that the separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path. It defaults to false, and a deployment that has never set it in any namespace is still affected, which was confirmed by running an affected release with no value for that setting present anywhere in dynamic configuration. To look for a compute configuration that is already attached, call DescribeWorkerDeploymentVersion for each worker deployment version in each namespace and check whether any scaling group\u0027s compute provider type is subprocess."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Command execution on the host running the Temporal Worker Service, as the operating system account the server process runs under, reachable from an ordinary namespace write role. That process holds the persistence credentials for every namespace in the cluster as well as the cluster\u0027s TLS material, so the effect is cross-namespace and cluster-wide rather than confined to the caller\u0027s own namespace. In the official container image the server runs as an unprivileged account rather than root, which bounds host takeover but does not bound access to the credentials and key material the server process itself holds."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-749",
              "description": "CWE-749: Exposed Dangerous Method or Function",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "CWE-1188: Initialization of a Resource with an Insecure Default",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T11:41:23.342Z",
        "orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
        "shortName": "Temporal"
      },
      "references": [
        {
          "name": "First fixed release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.32.0"
        },
        {
          "name": "Temporal Server 1.31.3, first fixed 1.31 release",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
        },
        {
          "name": "Fix pull request, compute provider allowlist changed to deny by default",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal-auto-scaled-workers/pull/129"
        },
        {
          "name": "Module bump carrying the fix into the Temporal Server 1.32 release branch",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/pull/12021"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to Temporal Server 1.32.0 or 1.31.3. Both pin a Worker Controller Instance module revision whose compute provider allowlist denies by default instead of permitting every registered provider. Operators who cannot upgrade immediately can apply the workaround below, which closes the same path without waiting for a release. The 1.30 release line does not depend on the Worker Controller Instance module at all and is unaffected. Note that the change shipped in 1.32.0 and 1.31.3 makes the allowlist deny by default and does not change where the executed command comes from: for a compute provider an operator does deliberately add to the allowlist, the program name and argument vector still arrive in the caller\u0027s request.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to Temporal Server 1.32.0 or 1.31.3. Both pin a Worker Controller Instance module revision whose compute provider allowlist denies by default instead of permitting every registered provider. Operators who cannot upgrade immediately can apply the workaround below, which closes the same path without waiting for a release. The 1.30 release line does not depend on the Worker Controller Instance module at all and is unaffected. Note that the change shipped in 1.32.0 and 1.31.3 makes the allowlist deny by default and does not change where the executed command comes from: for a compute provider an operator does deliberately add to the allowlist, the program name and argument vector still arrive in the caller\u0027s request."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eSet the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled to an explicit list naming only the compute providers the deployment intends to permit, omitting subprocess. An explicit empty list denies every compute provider. Leaving the setting unset is what permits everything, because the allowlist check is skipped when no value is configured; giving the setting any explicit value, an empty list included, makes the check run and denies any provider absent from the list. The request is then rejected with InvalidArgument before the provider runs. This is dynamic configuration, so it takes effect without restarting the server and is available during an incident rather than only at a maintenance window. Verify the effective value for every namespace in scope, including any namespace-constrained entries that could override a cluster-wide value.\u003c/p\u003e"
            }
          ],
          "value": "Set the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled to an explicit list naming only the compute providers the deployment intends to permit, omitting subprocess. An explicit empty list denies every compute provider. Leaving the setting unset is what permits everything, because the allowlist check is skipped when no value is configured; giving the setting any explicit value, an empty list included, makes the check run and denies any provider absent from the list. The request is then rejected with InvalidArgument before the provider runs. This is dynamic configuration, so it takes effect without restarting the server and is available during an incident rather than only at a maintenance window. Verify the effective value for every namespace in scope, including any namespace-constrained entries that could override a cluster-wide value."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
    "assignerShortName": "Temporal",
    "cveId": "CVE-2026-89139",
    "datePublished": "2026-09-21T11:41:23.342Z",
    "dateReserved": "2026-09-10T23:08:25.314Z",
    "dateUpdated": "2026-09-21T15:24:46.549Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GHSA-W8CX-4CF2-9HVR

CVE-2026-89139 (GCVE-0-2026-89139)

Tags

Sightings

Nomenclature

Related by attack behaviour