Description
Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving the caller's path, query, and request body. Where an internal frontend is deployed with its HTTP API enabled, that client resolves to the internal frontend, which authorizes every request as a system administrator without requiring authentication information. The result is that the server performs an attacker-chosen state-changing HTTP POST against its own administrative API on the caller's behalf, in namespaces where the caller has no permission. The caller never needs network access to the internal frontend, because the History service makes the request. Confirmed effects include terminating Workflows in other namespaces, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The affected routing logic is present in both the HSM and CHASM callback delivery implementations. This description and the CVSS score in this record describe releases 1.30.0 and later, where any non-empty source header is sufficient. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect in which the header must exactly match a configured cluster ID, a UUID that a namespace-scoped caller cannot read through the API. The consequence once that match occurs is the same, but the attack is materially harder and scores lower. To determine whether a deployment is affected, check two settings together: the static Server configuration for a non-zero services.internal-frontend.rpc.httpPort, and the effective per-namespace dynamic configuration value of component.callbacks.allowedAddresses. A deployment is exposed only when an internal frontend is deployed with a non-zero HTTP port, at least one allowlist rule admits a host, and authorization is enabled. The allowlist is empty by default, which denies all external callback URLs, and the stock static topology does not include an internal frontend. Note that a failed attach returns the error 'invalid url: url does not match any configured callback address', which proves only that one tested URL did not match and does not prove the effective allowlist is empty. To look for callbacks already attached, use DescribeWorkflowExecution, which returns callback information for a Workflow's registered completion callbacks. Operators should be aware of a gap when searching for evidence of delivery: the frontend HTTP API server records the request method and URL at debug level only, so at default log levels a delivered request is not written to the internal frontend's logs, and the absence of such log entries is not evidence that the issue was not exploited.
Published: 2026-09-21
Score: 7.2 High
EPSS: n/a
KEV: No
Impact: Administrative Privilege Escalation via Internal Callback Routing
Action: Patch Now
AI Analysis

Impact

Temporal Server incorrectly determines whether a Workflow completion callback is internal based on a caller-supplied HTTP header. An authenticated user with only write permissions in a single namespace can attach a callback whose URL host matches the internal callback allowlist. Because the callback source header is non‑empty, the History service rewrites the request to target the local frontend, preserving the caller’s path, query, and body. When that internal frontend’s HTTP API is enabled, the rewritten call is authorized as a system administrator, allowing the attacker to perform state‑changing operations such as terminating workflows or modifying namespace configurations in any namespace where the attacker has no rights. This flaw maps to CWE‑807, reflecting an improper trust of input data.

Affected Systems

Temporal Technologies, Inc. provides Temporal Server. Every release from 1.30.0 onward, including 1.30.7, 1.31.3, and 1.32.0, is affected when callback.inspectSourceHeader is set to true. Versions 1.25.0 through 1.29.7 also suffer a narrower variant that requires the source header to match a cluster‑ID UUID; despite the reduced attack surface, the same administrative consequences are possible. The issue is present only when an internal frontend is deployed with a non‑zero HTTP port and the component.callbacks.allowedAddresses allow at least one external callback host.

Risk and Exploitability

The vulnerability has a CVSS score of 7.2, indicating high severity. EPSS is not available, and the flaw is not listed in the CISA KEV catalog, implying no confirmed exploitation in the wild yet. The attack vector requires the attacker to be an authenticated client with write permissions in a namespace and for the cluster to expose an internal frontend HTTP API. With those conditions met, an attacker can cause the server to perform internal admin requests without network access to the internal frontend, making the exploit practical in misconfigured clusters. Administrators should therefore treat this as a high‑risk flaw and remediate promptly.

Generated by OpenCVE AI on September 21, 2026 at 12:21 UTC.

Remediation

Vendor Solution

Upgrade to Temporal Server 1.32.0, which ships callback.inspectSourceHeader set to false and needs no further change. The fix makes the completion-callback source header opt-in behind the callback.inspectSourceHeader setting, so a callback's internality is decided from the server-generated callback URL rather than from a caller-supplied header. Releases 1.30.7 and 1.31.3 carry the same code but ship callback.inspectSourceHeader set to true for mixed-version compatibility while callbacks created with the older callback URL template drain, and while it is true the routing behavior matches the affected releases; an operator upgrading within the 1.30 or 1.31 line must therefore also set callback.inspectSourceHeader to false once every pre-fix server has drained. Operators who set callback.inspectSourceHeader to true restore the pre-fix behavior in full, including preservation of the caller's path and query across the internal rewrite, and should not enable it on a cluster that accepts caller-supplied completion callbacks. Temporal Server releases in the 1.25.0 through 1.29.7 range are outside the supported window and receive no fix; operators on those releases should upgrade to a supported line.

Vendor Workaround

Until a fixed release is available, a cluster that does not accept externally addressed Workflow completion callbacks can set the effective component.callbacks.allowedAddresses dynamic configuration value to an empty list, and remove or empty any more specific namespace-constrained entries that admit a host. Verify the effective value for every namespace in scope. An absent key already has the same deny-all default, but an explicit empty value is easier to audit. This rejects external http and https callback URLs at StartWorkflowExecution, before persistence and before either delivery implementation runs. It is a targeted mitigation rather than a way to disable Nexus: the reserved internal forms temporal://system and temporal://internal remain admitted, and there is no supported cluster-wide setting that turns Nexus off. As a separate defense in depth, operators that do not need the internal frontend's HTTP API can remove that service or set services.internal-frontend.rpc.httpPort to zero after confirming no internal consumers depend on it; this closes the administrative amplifier but does not correct the routing defect itself. Restricting or removing Nexus endpoints is not sufficient, because attaching the affected completion callback does not require a registered Nexus endpoint.

OpenCVE Recommended Actions

  • Upgrade the Temporal Server to 1.32.0 or later, which disables the vulnerable header handling by default.
  • If you are on the 1.30.x or 1.31.x release line, drain all pre‑fix callbacks and then set callback.inspectSourceHeader to false in the server configuration to re‑enable the patch.
  • Tighten the component.callbacks.allowedAddresses dynamic configuration by setting it to an empty list for every namespace, thereby rejecting all external completion callbacks at the StartWorkflowExecution stage.
  • If internal frontend HTTP API usage is not required, set services.internal-frontend.rpc.httpPort to zero or remove the internal frontend service, closing the administrative amplifier.

Generated by OpenCVE AI on September 21, 2026 at 12:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 21 Sep 2026 11:45:00 +0000

Type Values Removed Values Added
Description Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving the caller's path, query, and request body. Where an internal frontend is deployed with its HTTP API enabled, that client resolves to the internal frontend, which authorizes every request as a system administrator without requiring authentication information. The result is that the server performs an attacker-chosen state-changing HTTP POST against its own administrative API on the caller's behalf, in namespaces where the caller has no permission. The caller never needs network access to the internal frontend, because the History service makes the request. Confirmed effects include terminating Workflows in other namespaces, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The affected routing logic is present in both the HSM and CHASM callback delivery implementations. This description and the CVSS score in this record describe releases 1.30.0 and later, where any non-empty source header is sufficient. Releases 1.25.0 through 1.29.7 are affected by a narrower form of the same defect in which the header must exactly match a configured cluster ID, a UUID that a namespace-scoped caller cannot read through the API. The consequence once that match occurs is the same, but the attack is materially harder and scores lower. To determine whether a deployment is affected, check two settings together: the static Server configuration for a non-zero services.internal-frontend.rpc.httpPort, and the effective per-namespace dynamic configuration value of component.callbacks.allowedAddresses. A deployment is exposed only when an internal frontend is deployed with a non-zero HTTP port, at least one allowlist rule admits a host, and authorization is enabled. The allowlist is empty by default, which denies all external callback URLs, and the stock static topology does not include an internal frontend. Note that a failed attach returns the error 'invalid url: url does not match any configured callback address', which proves only that one tested URL did not match and does not prove the effective allowlist is empty. To look for callbacks already attached, use DescribeWorkflowExecution, which returns callback information for a Workflow's registered completion callbacks. Operators should be aware of a gap when searching for evidence of delivery: the frontend HTTP API server records the request method and URL at debug level only, so at default log levels a delivered request is not written to the internal frontend's logs, and the absence of such log entries is not evidence that the issue was not exploited.
Title Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
First Time appeared Temporal
Temporal temporal
Weaknesses CWE-807
CPEs cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*
Vendors & Products Temporal
Temporal temporal
References
Metrics cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Temporal Temporal
cve-icon MITRE

Status: PUBLISHED

Assigner: Temporal

Published:

Updated: 2026-09-21T11:39:52.412Z

Reserved: 2026-09-09T13:05:43.884Z

Link: CVE-2026-87858

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-21T12:17:22.230

Modified: 2026-09-21T12:17:22.230

Link: CVE-2026-87858

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-21T12:30:14Z

Weaknesses
  • CWE-807

    Reliance on Untrusted Inputs in a Security Decision