CVE-2026-16652

Name of the Vulnerable Software and Affected Versions Temporal Server (affected versions not specified)

Description An authenticated user with namespace write permissions can cause a denial of service by creating or updating a Schedule that uses a fine-grained cadence combined with an exclusion calendar that rejects all candidate times. This occurs because the server does not limit the work performed when searching for the next action time, leading to excessive CPU consumption in the Frontend and Schedule worker components. Additionally, a persisted specification may cause the associated Schedule Workflow to fail and retry repeatedly, sustaining high CPU usage until the Schedule is deleted or the Workflow is terminated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.