CVE-2026-104355 Temporal Technologies, Inc. CVE debrief

Who should care

Temporal Server administrators and users, especially those with multi-cluster deployments, should assess exposure and verify updates to prevent unauthorized namespace modifications. This includes reviewing current deployments, checking for affected versions, and applying patches or mitigations as necessary. Security teams should also monitor namespace changes and adjust configurations to minimize exposure.

Why it matters

CVE-2026-104355 is a high-severity vulnerability in Temporal Server that allows a connected peer cluster to modify local namespaces without proper validation, potentially leading to unauthorized changes. Defenders should prioritize verifying and updating affected instances to prevent unauthorized namespace modifications.

• Verify and update affected Temporal Server instances to prevent unauthorized namespace modifications
• Restrict peer cluster connections to minimize exposure
• Monitor namespace changes for suspicious activity

Technical summary

The vulnerability allows a connected peer cluster to modify local namespaces in Temporal Server without proper validation, potentially leading to unauthorized changes. This occurs because the receiving cluster applies inbound namespace replication updates to local namespaces without checking if they are global. An attacker controlling a registered peer's replies can change any local namespace by supplying its name and identifier, allowing actions like marking it as Deprecated or making the peer its active cluster. Fixes are available in versions 1.30.8, 1.31.4, and 1.32.1.

Defensive priority

Defenders should prioritize verifying and updating affected Temporal Server instances to prevent unauthorized namespace modifications.

Recommended defensive actions

• Verify and update affected Temporal Server instances to prevent unauthorized namespace modifications
• Review and restrict peer cluster connections to minimize exposure
• Monitor namespace changes for suspicious activity
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is confirmed in Temporal Server versions 1.0.0 to 1.32.0, with fixes available in versions 1.30.8, 1.31.4, and 1.32.1. Evidence is based on source-provided information and limited to public data. Defenders should verify affected versions and apply patches or mitigations as recommended by the vendor. Additional verification steps may be necessary to confirm exposure in specific environments.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.