The vulnerability originates from missing authentication in the frontend gRPC server’s streaming interceptor chain. When a ClaimMapper and Authorizer are configured, unary RPCs require credentials, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint does not enforce authentication. Consequently, an attacker with access to the frontend port can open the replication stream without credentials. Data exfiltration is possible, yet it requires a correctly configured replication target and the attacker’s knowledge of the cluster configuration, as the history service validates cluster IDs and peer membership before transmitting data.

Executables from Temporal Technologies, Inc. marked as temporal are impacted. Any deployment of Temporal that includes a replication target and uses the default streaming replication endpoint is vulnerable until an update is applied. The patch versions listed in the advisory – effectively v1.28.4 and all later releases – have addressed the issue.

The CVSS score of 6.3 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in the CISA KEV catalog, suggesting it is not actively exploited at scale. The most likely attack vector is a malicious entity that can reach the frontend gRPC port, which is often exposed to internal or compromised networks. Exploitation also mandates knowledge of the cluster configuration and a functional replication target; therefore, risk is higher in environments where replication is enabled and not properly isolated. Users should treat the vulnerability as potentially serious if sensitive workflow history is present.