CVE-2026-5724 Details

A vulnerability exists in the frontend gRPC server of Temporal that allows unauthorized access to a streaming endpoint. The issue arises because the server's streaming interceptor chain does not include an authorization interceptor. As a result, when a ClaimMapper and Authorizer are configured, unary RPCs properly enforce authentication and authorization. However, the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepts requests without credentials. This endpoint, which cannot be disabled independently, is registered on the same port as the WorkflowService. An attacker with network access to the frontend port could exploit this vulnerability by opening the replication stream without authentication. While data exfiltration is possible, it requires knowledge of the cluster configuration and a properly configured replication target, as the history service validates cluster IDs and peer membership before releasing replication data. Notably, this vulnerability does not affect Temporal Cloud.

Users can update to Temporal versions 1.28.4, 1.29.6, or 1.30.4, all of which address this vulnerability. After updating, if using authorization with a replication setup, it is recommended to set the system.disableStreamingAuthorizer dynamic config to true to avoid replication traffic connection errors.