CVE-2026-65655 Temporal Technologies, Inc. CVE debrief

Who should care

Defenders responsible for configuring and securing Temporal UI Server instances should assess exposure and verify authentication configuration. This includes reviewing the authentication setup, ensuring that browser-facing TLS terminates at a reverse proxy and the proxy forwards the callback to Temporal UI Server over HTTPS, and implementing additional security measures such as Effective HSTS or TLS re-encryption between the proxy and Temporal UI Server.

Why it matters

CVE-2026-65655 is a low-severity issue in Temporal UI Server that allows potential credential exposure when OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy. Defenders should assess exposure, verify authentication configuration, and implement additional security measures to prevent credential exposure.

• Credential exposure requires specific conditions to be met, including attacker control of content, ability to steer traffic, and read plaintext requests
• A recovered credential may be replayed within the victim's assigned permissions
• Refresh-token replay depends on the identity provider's issuance, expiry, rotation, and reuse-detection behavior
• Effective HSTS or TLS re-encryption can prevent the demonstrated disclosure path

Technical summary

The CVE-2026-65655 issue in Temporal UI Server allows potential credential exposure when OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP. A victim who visits attacker-controlled content while a credential remains live may expose that credential only if the attacker can also steer traffic for the UI hostname, prevent the browser's HTTPS connection from succeeding, serve the hostname over HTTP, and read a later same-site plaintext request.

Defensive priority

Assess exposure and verify authentication configuration

Recommended defensive actions

• Assess exposure by reviewing Temporal UI Server configuration and authentication setup
• Verify that browser-facing TLS terminates at a reverse proxy and the proxy forwards the callback to Temporal UI Server over HTTPS
• Implement Effective HSTS, a blocking HTTPS-only warning, or TLS re-encryption between the proxy and Temporal UI Server to prevent the demonstrated disclosure path
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source references provide details on the OAuth authentication issue in Temporal UI Server. The issue allows potential credential exposure when browser-facing TLS terminates at a reverse proxy and the proxy forwards the callback to Temporal UI Server over HTTP.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.