CVE-2026-65655 debrief: Temporal UI Server OAuth authentication issue allows potential credential exposure. The vulnerability arises when OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP. Affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection, allowing Temporal UI Se [truncated]
MEDIUMTemporal Technologies, Inc.CVE published 2026-04-10
The CVE record describes a vulnerability in Temporal's frontend gRPC server. The server's streaming interceptor chain did not include the authorization interceptor. This omission allowed unauthenticated access to the streaming AdminService/StreamWorkflowReplicationMessages endpoint. The endpoint, registered on the same port as WorkflowService, could not be disabled independently. An attacker with network [truncated]
