—

GO-2026-5766

Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster in go.temporal.io/server

Quick fix

GO-2026-5766 — go.temporal.io/server: upgrade to the fixed version with the command below.

go get go.temporal.io/server@v1.29.5

Details

Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster in go.temporal.io/server

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / go.temporal.io/server

Introduced in: 0 Fixed in: 1.29.5

Fix go get go.temporal.io/server@v1.29.5

References

https://github.com/advisories/GHSA-xpg8-3hhp-p7w8 [ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2026-5199 [ADVISORY]
https://github.com/temporalio/temporal/releases/tag/v1.29.5 [WEB]
https://github.com/temporalio/temporal/releases/tag/v1.30.3 [WEB]