CVE-2026-87858

Name of the Vulnerable Software and Affected Versions Temporal Server versions 1.25.0 through 1.30.x

Description An authenticated user with write permissions in a single namespace can trigger unauthorized administrative actions by exploiting how the server identifies internal Workflow completion callbacks. By attaching a callback with a URL host that matches the configured allowlist and including a non-empty source header, the History service re-targets the request to the local internal frontend. If the internal frontend has its HTTP API enabled, it authorizes these requests as a system administrator without requiring authentication. This allows an attacker to perform state-changing HTTP POST requests against the administrative API, enabling them to terminate workflows, register or delete namespaces, and modify namespace configurations in areas where they lack permission. This issue affects both HSM and CHASM callback delivery implementations. In versions 1.30.0 and later, any non-empty source header triggers the behavior, while in versions 1.25.0 through 1.29.7, the header must exactly match a specific cluster ID.

Recommendations For versions 1.25.0 through 1.30.x, ensure that the services.internal-frontend.rpc.httpPort is set to zero or that the component.callbacks.allowedAddresses allowlist is empty to prevent external callback URLs from being processed. As a temporary mitigation, restrict the use of the source header in completion callbacks to prevent the re-targeting of requests to the internal frontend.