This vulnerability occurs because the s2s‑proxy uses Go's RequireAnyClientCert mode without verifying the certificate against the configured CA. An attacker can supply any self‑signed certificate and its private key and establish a TLS and yamux session. Once connected, the proxy will accept RPCs that the configuration permits, allowing the attacker to perform privileged operations against the Temporal cluster without possessing a valid certificate, credential, or trusted key.

The Temporal Technologies s2s‑proxy, versions 0.1.16 through 0.2.2, are affected. All published builds up to 0.2.2 contain the flaw. The issue is fixed in version 0.2.3 and later.

The CVSS score of 9.3 categorizes the issue as critical. Because the defect lies in TLS client authentication, a remote attacker can exploit the weakness without physical access or prior credentials. No knowledge of a Temporal credential or trusted certificate is required, which enlarges the attack surface. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the severity and reach of the flaw remain high. Until a patched version is deployed, the risk remains significant, especially if the proxy is exposed beyond a secure network or internal boundary.