CVE-2026-87858: 
Wolfi vulnerability analysis and mitigation

CVE-2026-87858 is an authorization bypass vulnerability in Temporal Server (go.temporal.io/server) that allows an authenticated attacker with write permission in a single namespace to perform administrative API operations across other namespaces by forging a caller-supplied HTTP header. The vulnerability was published on September 21, 2026, and affects versions 1.25.0–1.29.7, 1.30.0–1.30.6, and 1.31.0–1.31.2. It carries a CVSS v4.0 base score of 7.2 (High) (GitHub Advisory).

The root cause is CWE-807 (Reliance on Untrusted Inputs in a Security Decision): Temporal Server determined whether a Workflow completion callback was internal by inspecting a caller-supplied HTTP header named source, rather than using a server-controlled signal (GitHub Advisory). An attacker attaches a completion callback whose URL host matches the configured callback address allowlist and whose URL path targets any Temporal HTTP API route, then includes a non-empty source header. When the History service delivers the callback, the non-empty source header causes the request to be re-targeted at the local internal frontend client, rewriting only the scheme and host while preserving the attacker's chosen path, query, and request body. The internal frontend authorizes all such requests as a system administrator without requiring authentication credentials, effectively granting the attacker full administrative access. The flaw exists in both the HSM and CHASM callback delivery implementations; in versions 1.25.0–1.29.7, the header must exactly match a configured cluster UUID (making exploitation harder), while in 1.30.0+, any non-empty source header value is sufficient (GitHub Advisory, PR #11965).

A successful exploit allows an authenticated attacker with only single-namespace write permission to execute arbitrary administrative HTTP POST operations against the Temporal server's internal API as a system administrator, without needing direct network access to the internal frontend. Confirmed impacts include terminating Workflows in other namespaces, registering new namespaces, modifying namespace configurations, and deleting namespaces along with all their Workflows (GitHub Advisory). The vulnerability primarily affects integrity and availability (no confidentiality impact is indicated), and can result in significant disruption to multi-tenant Temporal deployments where namespace isolation is a security boundary.

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at the time of disclosure (GitHub Advisory). The NVD SSVC assessment rates exploitation as "none" and the vulnerability as non-automatable. Exploitation requires an authenticated account with at least write permission to one namespace, and the deployment must have an internal frontend with a non-zero HTTP port and at least one allowlist rule permitting external callback URLs — conditions that are not present in default Temporal deployments. No threat actor attribution or CISA KEV catalog listing has been identified.

1. Reconnaissance: Identify a Temporal Server deployment running versions 1.25.0–1.31.2 with an internal frontend HTTP API enabled (services.internal-frontend.rpc.httpPort set to a non-zero value) and at least one entry in the component.callbacks.allowedAddresses dynamic configuration.
2. Obtain credentials: Acquire authenticated credentials with write permission to at least one namespace (e.g., via a legitimate user account or compromised service account).
3. Craft a malicious callback: Using the Temporal API, attach a Workflow completion callback to a Workflow in the attacker-controlled namespace. Set the callback URL host to a value matching the configured allowlist, and set the URL path to the target administrative API route (e.g., a route for terminating Workflows, registering namespaces, or deleting namespaces in another namespace).
4. Inject the source header: Include a non-empty HTTP header named source in the callback's header map. In versions 1.30.0+, any non-empty value is sufficient; in versions 1.25.0–1.29.7, the value must match the cluster UUID.
5. Trigger callback delivery: Allow or force the target Workflow to complete, causing the History service to deliver the callback. The History service re-targets the request to the internal frontend, rewriting only the scheme and host while preserving the attacker's path, query, and body.
6. Achieve unauthorized administrative action: The internal frontend processes the request as a system administrator, executing the attacker-chosen state-changing operation (e.g., terminating Workflows, deleting namespaces) in namespaces where the attacker has no permission (GitHub Advisory).

• Logs: The internal frontend HTTP API server logs request method and URL at debug level only; at default log levels, delivered requests are not recorded — absence of log entries does not rule out exploitation (GitHub Advisory).
• Workflow Metadata: Use DescribeWorkflowExecution on Workflows to inspect registered completion callbacks; unexpected callback URLs targeting internal Temporal API routes with allowlisted hosts are a strong indicator of abuse.
• Namespace Activity: Unexpected namespace registrations, configuration changes, or deletions — especially in namespaces not managed by the suspected actor — may indicate exploitation.
• Workflow Terminations: Unexplained Workflow terminations across namespaces, particularly those not initiated by namespace owners, should be investigated.

Upgrade to patched versions: v1.30.7, v1.31.3, or v1.32.0 (v1.30.7 Release, v1.31.3 Release, v1.32.0 Release). The fix makes source header inspection opt-in via the callback.inspectSourceHeader configuration flag (defaulting to false in 1.32.0+), so that URL-scheme routing is used by default instead of trusting the caller-supplied header. As an immediate workaround, restrict or disable the internal frontend HTTP API (set services.internal-frontend.rpc.httpPort to zero) and ensure the component.callbacks.allowedAddresses allowlist is empty if callback functionality is not required. Operators should also audit existing Workflows using DescribeWorkflowExecution to check for suspicious completion callbacks already attached (GitHub Advisory, PR #11965).