{"id":"CVE-2026-120091","kind":"vulnerability","aliases":["CVE-2026-120091"],"related":[],"title":"Temporal Server: a read-only namespace caller can run commands on the host","description":"Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line does not include the Worker Controller Instance module and is unaffected. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is in an affected range. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective value of workercontroller.compute_providers.enabled contains k8s, or, on 1.31.0 through 1.31.2 only, is unset; check both the global value and every namespace-constrained override, because an override can add k8s for a single namespace. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Deployments that use a custom authorizer should also check whether it permits ValidateWorkerDeploymentVersionComputeConfig to callers without namespace write access. The separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path on any affected release.","summary":"Temporal Server's Worker Service ships a Kubernetes compute provider that builds its client from caller-supplied configuration during validation. An authenticated caller with only a read role in one namespace can run an attacker-chosen command on the Worker Service host, which holds persistence and TLS credentials for the whole cluster.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kubernetes","runtime","self-hosted","temporal-server","worker-service"],"not_affected_if":["compute-provider-denies-k8s","managed-hosting","no-k8s-compute-provider","temporal-1.30"],"how_to_check":"- Check the deployed Temporal Server version against the affected ranges (1.31.0 through 1.31.2, and other 1.31/1.32 releases before the fixes): `temporal-server --version` or the running image tag.\n- Read the effective `workercontroller.compute_providers.enabled` setting, both global and per-namespace overrides, and see whether it contains `k8s` or is unset on 1.31.0 through 1.31.2.\n- Confirm whether a real authorizer and claim mapper are configured; a deployment with no authorizer is not bounded by namespace and is treated as exposed in the sources' framing.\n- If a custom authorizer is used, check whether it allows `ValidateWorkerDeploymentVersionComputeConfig` for callers without namespace write access.","fix":"- Temporal Server 1.31.x: move to `1.31.3` or later.\n- Temporal Server 1.32.x: move to `1.32.0` or later.\n- Temporal Server 1.31.0 through 1.31.2 with unset compute provider setting: the sources state the allowlist does not deny by default there, so the fixed releases above are the stated remedy.","status":"open","published_at":"2026-11-02T22:17:20+00:00","first_seen_at":"2026-11-02T22:35:43+00:00","triaged_at":"2026-11-02T22:37:49+00:00","updated_at":"2026-11-02T22:37:49+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-02T22:37:49Z","model":"claude-haiku-5-5","output":{"fix":"- Temporal Server 1.31.x: move to `1.31.3` or later.\n- Temporal Server 1.32.x: move to `1.32.0` or later.\n- Temporal Server 1.31.0 through 1.31.2 with unset compute provider setting: the sources state the allowlist does not deny by default there, so the fixed releases above are the stated remedy.","reach":"network","title":"Temporal Server: a read-only namespace caller can run commands on the host","impact":"high","summary":"Temporal Server's Worker Service ships a Kubernetes compute provider that builds its client from caller-supplied configuration during validation. An authenticated caller with only a read role in one namespace can run an attacker-chosen command on the Worker Service host, which holds persistence and TLS credentials for the whole cluster.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["temporal-server","self-hosted","kubernetes","worker-service"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs commands on Worker Service host, reaching cluster-wide credentials","analyst_note":"Confirm the exact fixed versions and whether 1.31.0 through 1.31.2 need a setting change beyond upgrading; check the linked release notes.","how_to_check":"- Check the deployed Temporal Server version against the affected ranges (1.31.0 through 1.31.2, and other 1.31/1.32 releases before the fixes): `temporal-server --version` or the running image tag.\n- Read the effective `workercontroller.compute_providers.enabled` setting, both global and per-namespace overrides, and see whether it contains `k8s` or is unset on 1.31.0 through 1.31.2.\n- Confirm whether a real authorizer and claim mapper are configured; a deployment with no authorizer is not bounded by namespace and is treated as exposed in the sources' framing.\n- If a custom authorizer is used, check whether it allows `ValidateWorkerDeploymentVersionComputeConfig` for callers without namespace write access.","plain_action":"","needs_analyst":true,"not_affected_if":["temporal-1.30","compute-provider-denies-k8s","no-k8s-compute-provider","managed-hosting"],"who_is_affected":"Only deployments running affected Temporal Server releases with the Worker Service active, which is the default service set. Exposure requires the compute provider allowlist to permit k8s (or to be unset on 1.31.0 through 1.31.2) and a real authorizer to be configured; deployments on 1.30 are unaffected, and a deployment with no authorizer already grants every caller access to every namespace.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000976,"input_tokens":5005,"output_tokens":951,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-120091':17A,20A '-2026':16A,19A '/auto-scaled-workers,':96C '1.30':385C '1.31':357C '1.31.0':316C,448C '1.31.2':318C,450C '1.31.3':354C '1.32':364C '1.32.0':361C 'access':500C,532C 'account':165C 'add':381C,469C 'affect':295C,405C,418C,546C,550C 'allowlist':307C,320C,367C 'alreadi':222C,495C 'also':521C 'arriv':237C 'attack':68B 'attacker-chosen':67B 'authent':54B,195C 'author':476C,482C,494C,519C 'beyond':268C 'binari':289C 'boundari':509C 'build':43B,144C 'built':124C 'caller':8A,48B,55B,135C,155C,196C,270C,498C,528C 'caller-suppli':47B 'check':332C,406C,454C,522C 'choos':157C 'chosen':69B 'claim':484C 'client':45B,127C,130C,148C 'cluster':85B,120C,258C,261C,275C 'command':11A,70B,152C 'compil':88C 'comput':40B,106C,305C,338C 'configur':50B,131C,142C,229C,310C,478C,539C 'consequ':266C 'constrain':463C 'contain':291C,444C 'control':91C,298C,393C 'could':149C 'createworkerdeploymentvers':177C 'credenti':81B,252C 'cross':513C 'custom':518C 'cve':15A,18A 'decis':235C 'default':325C,370C,430C 'deni':323C,368C 'deploy':220C,347C,373C,403C,411C,438C,490C,514C 'determin':400C 'dynam':309C,538C 'effect':440C 'everi':254C,336C,460C,497C,502C 'execut':224C 'exist':223C 'expos':352C,375C 'follow':408C 'frontend':172C 'function':111C 'gate':544C 'global':457C 'go.temporal.io':95C 'go.temporal.io/auto-scaled-workers,':94C 'grant':496C 'happen':225C 'hold':77B,197C,249C 'host':14A,25B,75B,162C 'imag':292C 'includ':343C,390C 'instanc':92C,394C 'k8s':109C,122C,342C,378C,445C,470C 'keep':300C 'kubernet':21B,39B,119C,126C 'later':356C,363C 'line':387C 'manag':114C 'mapper':485C 'materi':264C 'mean':479C 'modul':93C,103C,395C 'name':108C 'namespac':7A,63B,180C,191C,205C,255C,272C,462C,474C,503C,508C,530C,537C 'namespace-constrain':461C 'offici':285C 'one':62B 'oper':141C,173C,192C 'overrid':464C,467C 'path':547C 'per':536C 'per-namespac':535C 'permit':341C,525C 'persist':78B,251C 'place':488C 'present':282C 'process':168C,248C 'provid':41B,107C,123C,176C,209C,280C,306C,339C 'rang':419C 'rather':138C 'reach':174C,207C,267C 'read':5A,59B,189C,200C 'read-on':4A,188C 'real':481C 'regist':104C,185C,337C 'releas':296C,350C,358C,365C,386C,551C 'request':137C,240C 'requir':178C,217C,243C 'role':60B,182C,201C 'rout':214C 'run':10A,65B,116C,150C,169C,424C,491C 'runtim':22B 'scale':234C 'self':24B 'self-host':23B 'separ':534C 'sequenc':241C 'server':2A,28B,33B,87C,167C,288C,315C,413C 'servic':31B,36B,74B,100C,161C,247C,422C,431C 'set':311C,328C,432C,540C 'ship':37B 'singl':204C,473C 'skip':334C 'stock':346C,437C 'submit':228C 'suppli':49B,132C 'task':236C 'tempor':1A,27B,32B,86C,287C,314C,412C 'temporal-serv':26B,286C 'therefor':434C 'tls':80B,263C 'togeth':409C 'two':171C 'unaffect':398C 'unreach':302C 'unrestrict':499C 'unset':330C,453C 'unusu':239C 'use':146C,516C 'valid':52B,231C 'validateworkerdeploymentversioncomputeconfig':183C,526C 'valu':441C,458C 'version':414C 'whether':401C,523C 'whole':84B,278C 'whose':110C 'without':529C 'worker':30B,35B,73B,90C,99C,115C,160C,219C,246C,392C,421C 'worker-servic':29B 'workercontroller.compute_providers.enabled':312C,443C 'workercontroller.enabled':541C 'write':181C,531C","nicknames":[],"mitigations":[],"who_affected":"Only deployments running affected Temporal Server releases with the Worker Service active, which is the default service set. Exposure requires the compute provider allowlist to permit k8s (or to be unset on 1.31.0 through 1.31.2) and a real authorizer to be configured; deployments on 1.30 are unaffected, and a deployment with no authorizer already grants every caller access to every namespace.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","kubernetes","runtime","selfhosted","temporalserver","workerservice"],"first_public_at":"2026-11-02T22:17:20+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@temporal.io","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120091","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120091","severity":null,"published_at":"2026-11-02T22:17:20+00:00","modified_at":"2026-11-02T22:17:20+00:00","first_seen_at":"2026-11-02T22:35:43+00:00","fetched_at":"2026-11-02T22:35:43+00:00","note":null}],"documents":[{"id":54167,"url":"https://github.com/temporalio/temporal/releases/tag/v1.31.5","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":54168,"url":"https://github.com/temporalio/temporal/releases/tag/v1.32.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}