Description
Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace's workflow history, provided the supplied workflow identifier selects the same History shard as the continuation's branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller's current credential no longer granted access to the continuation's namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token's branch token is not the requested execution's current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading "Pagination branch token is not the execution's current branch token" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state.
Published: 2026-11-09
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Unauthorized Workflow History Exposure
Action: Immediate Patch
AI Analysis

Impact

Temporal Server fails to tie a workflow‑history pagination token to the namespace and workflow named in the request. An authenticated caller with read permission on one namespace can supply a legitimately issued continuation token from a second namespace and retrieve that second namespace’s history events, even though no workflow with that name exists. The vulnerability allows an insider or compromised credential to read private workflow histories across namespaces, exposing potentially sensitive data. The flaw does not provide write or execution privileges, nor does it enable unauthenticated access, so the impact is limited to confidentiality of history records.

Affected Systems

Vendor Temporal Technologies, Inc. offers the Temporal Server product. All releases from 1.16.0 up through 1.29.7 are affected because they lack the necessary binding check on either the forward or reverse history paths. The fix is available in versions 1.30.7, 1.31.3 and 1.32.0, which add the validation and keep the configuration defaults of history.enablePaginationTokenBranchValidation = true and history.enablePaginationTokenBranchValidationShadowMode = false.

Risk and Exploitability

The CVSS score of 5.3 indicates a medium severity vulnerability. With no publicly available EPSS score, the exact likelihood of exploitation is undetermined, but the flaw requires the attacker to already possess read access to some namespace. No configuration can restore the missing check in affected releases; monitoring logs for the warning – pagination_token_branch_mismatch – and observing InvalidArgument responses will reveal attempted abuses. Because the issue does not grant arbitrary code execution and is limited to the data owned by the attacker’s permissions, the overall risk is moderate, but it should be addressed promptly when feasible.

Generated by OpenCVE AI on November 9, 2026 at 22:14 UTC.

Remediation

Vendor Solution

Upgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and leave history.enablePaginationTokenBranchValidation at its default of true and history.enablePaginationTokenBranchValidationShadowMode at its default of false. The fix loads mutable state for the namespace and workflow named in the authorized request together with the run identifier from the page token, requires the token's branch token to equal that execution's current branch token, and rejects the request before any history persistence read. It covers the forward decoded, forward raw, and reverse history paths; the forward long-poll refresh path independently replaces the caller's branch token with the authorized execution's current branch token before reading history. Temporal Server releases up to and including 1.29.7 are outside the supported window and receive no fix; operators on those releases should upgrade to a supported line.

Vendor Workaround

No setting in an affected release closes this issue, because the binding check does not exist there. Until upgrading, limit exposure by granting namespace read permission only to principals trusted with every namespace they can reach, revoking and reissuing credentials through a mechanism that does not leave prior pagination state usable, treating history page tokens as sensitive and keeping them out of application logs, traces, error reports, and shared storage, and reducing namespace retention so that a referenced history branch becomes unavailable sooner after a workflow closes. A Payload Codec reduces the sensitivity of disclosed payload bodies but does not prevent the unauthorized read or protect history metadata. A long-running open workflow can outlive its namespace's closed-execution retention duration, because that duration is measured from workflow closure.

OpenCVE Recommended Actions

  • Upgrade Temporal Server to a supported release—1.30.7, 1.31.3, or 1.32.0—ensuring history.enablePaginationTokenBranchValidation stays enabled and history.enablePaginationTokenBranchValidationShadowMode remains disabled.
  • Limit the namespace read permission to principals that truly need access; revoke and reissue credentials so that any existing pagination tokens cannot be reused after credential rotation.
  • Treat pagination tokens as sensitive: remove them from application logs, traces, error reports, and shared storage to reduce the window for exploitation.
  • Reduce namespace retention periods so that history branches become unavailable sooner after workflow completion, limiting the amount of data that can be extracted from a stale token.
  • Continuously monitor Temporal logs for the warning message "Pagination branch token is not the execution's current branch token" and for InvalidArgument responses indicating CurrentBranchChangedFailure to detect abuse.

Generated by OpenCVE AI on November 9, 2026 at 22:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 20:00:00 +0000

Type Values Removed Values Added
Description Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace's workflow history, provided the supplied workflow identifier selects the same History shard as the continuation's branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller's current credential no longer granted access to the continuation's namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token's branch token is not the requested execution's current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading "Pagination branch token is not the execution's current branch token" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state.
Title Temporal Server workflow-history pagination token is not bound to the requested namespace and workflow
First Time appeared Temporal
Temporal temporal
Weaknesses CWE-639
CWE-863
CPEs cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*
Vendors & Products Temporal
Temporal temporal
References
Metrics cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Temporal Temporal
cve-icon MITRE

Status: PUBLISHED

Assigner: Temporal

Published:

Updated: 2026-11-09T19:45:14.927Z

Reserved: 2026-09-09T13:05:41.629Z

Link: CVE-2026-87857

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-11-09T20:18:14.997

Modified: 2026-11-09T20:18:14.997

Link: CVE-2026-87857

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T22:15:15Z

Weaknesses
  • CWE-639

    Authorization Bypass Through User-Controlled Key

  • CWE-863

    Incorrect Authorization