Description
Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line does not include the Worker Controller Instance module and is unaffected. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is in an affected range. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective value of workercontroller.compute_providers.enabled contains k8s, or, on 1.31.0 through 1.31.2 only, is unset; check both the global value and every namespace-constrained override, because an override can add k8s for a single namespace. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Deployments that use a custom authorizer should also check whether it permits ValidateWorkerDeploymentVersionComputeConfig to callers without namespace write access. The separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path on any affected release.
Published: 2026-11-02
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

Temporal Server's Worker Controller Instance module registers a k8s compute provider that builds a Kubernetes client from configuration supplied by the caller. This allows the provider to execute arbitrary commands on the Worker Service host, as the server process runs with cluster persistence and TLS credentials. The vulnerability is identified as CWE‑78 (OS Command Injection) and other CWEs. The result is remote code execution on the server and full cluster compromise, affecting confidentiality, integrity, and availability.

Affected Systems

The affected product is Temporal Server from Temporal Technologies, Inc. Versions 1.31.0 through 1.31.2, and 1.32.0 and later, are vulnerable if the dynamic configuration setting workercontroller.compute_providers.enabled includes or does not deny the k8s provider. Versions 1.32.2 and 1.31.5 removed the k8s compute provider from default builds, making the flaw non‑existent in those releases. The 1.30 line is unaffected because it does not contain the module.

Risk and Exploitability

The CVSS score of 8.7 indicates a high severity vulnerability. EPSS data is not available but the lack of a KEV listing suggests no known active exploitation, yet the attack can be carried out by any authenticated caller that can invoke the read‑only ValidateWorkerDeploymentVersionComputeConfig endpoint. Based on the description, it is inferred that the attacker can trigger the vulnerability by making a call to the ValidateWorkerDeploymentVersionComputeConfig endpoint with a crafted compute configuration, which does not require a worker deployment to exist. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole.

Generated by OpenCVE AI on November 2, 2026 at 22:50 UTC.

Remediation

Vendor Solution

Upgrade to Temporal Server 1.32.2 or 1.31.5. Both remove the k8s compute provider from default builds, so it is no longer compiled into the official binaries and container images, and both require a namespace write role for ValidateWorkerDeploymentVersionComputeConfig. Operators who cannot upgrade immediately can apply the workaround below, which closes the same path without waiting for a release. The 1.30 release line does not depend on the Worker Controller Instance module at all and is unaffected. Note that the fixed releases remove the provider from default builds and do not change where its Kubernetes client configuration comes from: an operator who builds Temporal Server with the k8s compute provider included and permits it in the allowlist still accepts that configuration from the caller's request.

Vendor Workaround

Remove k8s from the dynamic configuration setting workercontroller.compute_providers.enabled, at the global level and in every namespace-constrained override. On Temporal Server 1.31.0 through 1.31.2, also set the setting to an explicit list naming only the compute providers the deployment intends to permit, omitting k8s, because leaving it unset permits every registered provider; an explicit empty list denies every compute provider. The request is then rejected with InvalidArgument before the provider runs. This is dynamic configuration, so it takes effect without restarting the server and is available during an incident rather than only at a maintenance window. Deployments that use a custom authorizer can additionally require namespace write access for ValidateWorkerDeploymentVersionComputeConfig, which removes the read-role route but not the write-role route.

OpenCVE Recommended Actions

  • Upgrade to Temporal Server 1.32.2 or 1.31.5 or later, which removed the k8s compute provider from default builds
  • If an upgrade is not possible, disable the k8s provider by removing it from the workercontroller.compute_providers.enabled setting or setting the list to empty; apply the change at the global level and in all namespace‑constrained overrides
  • Configure an authorizer that restricts ValidateWorkerDeploymentVersionComputeConfig to callers with namespace write access, so that the read‑only route cannot be reached without proper permissions

Generated by OpenCVE AI on November 2, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 02 Nov 2026 21:30:00 +0000

Type Values Removed Values Added
Description Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line does not include the Worker Controller Instance module and is unaffected. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is in an affected range. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective value of workercontroller.compute_providers.enabled contains k8s, or, on 1.31.0 through 1.31.2 only, is unset; check both the global value and every namespace-constrained override, because an override can add k8s for a single namespace. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Deployments that use a custom authorizer should also check whether it permits ValidateWorkerDeploymentVersionComputeConfig to callers without namespace write access. The separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path on any affected release.
Title Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host
First Time appeared Temporal
Temporal temporal
Weaknesses CWE-1188
CWE-749
CWE-78
CWE-863
CPEs cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*
Vendors & Products Temporal
Temporal temporal
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Temporal Temporal
cve-icon MITRE

Status: PUBLISHED

Assigner: Temporal

Published:

Updated: 2026-11-02T21:19:19.927Z

Reserved: 2026-10-30T20:38:31.469Z

Link: CVE-2026-120091

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-02T22:17:20.567

Modified: 2026-11-02T22:17:20.567

Link: CVE-2026-120091

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-03T00:15:14Z

Weaknesses
  • CWE-1188

    Initialization of a Resource with an Insecure Default

  • CWE-749

    Exposed Dangerous Method or Function

  • CWE-78

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  • CWE-863

    Incorrect Authorization