LOW3.0Go
GHSA-gm2g-2xr9-pxxj· BIT-temporal-2023-3485, CVE-2023-3485Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource
Modified: 9/10/2026
package
Go/go.temporal.io/server
pkg:go/go.temporal.io/server
MEDIUMGo
GHSA-hmhp-gh8m-c8xp· CVE-2025-14987, GO-2026-4273Temporal has an Incorrect Authorization vulnerability
Modified: 2/3/2026
LOWGo
GHSA-p2gr-hm8g-q772· CVE-2025-14986, GO-2025-4272Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts
Modified: 9/10/2026
MEDIUMGo
GHSA-p768-c3pr-6459· CVE-2025-8396, GO-2025-3953Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling
Modified: 9/10/2026
MEDIUMGo
GHSA-q98v-9f9w-f49q· CVE-2026-5724, GO-2026-5578Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint
Modified: 9/10/2026
LOWGo
GHSA-xpg8-3hhp-p7w8· CVE-2026-5199, GO-2026-5766Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster
Modified: 9/10/2026
—Go
GO-2023-1879· BIT-temporal-2023-3485, CVE-2023-3485Temporal Server vulnerable to Incorrect Authorization and Insecure Default Initialization of Resource in go.temporal.io/server
Modified: 2/4/2026
—Go
GO-2024-2689· CVE-2024-2689, GHSA-wmxc-v39r-p9wfTemporal Server Denial of Service in go.temporal.io/server
Modified: 3/3/2026
—Go
GO-2025-3953· CVE-2025-8396, GHSA-p768-c3pr-6459Temporal OSS Server Vulnerable to Allocation of Resources Without Limits or Throttling in go.temporal.io/server
Modified: 2/4/2026
—Go
GO-2025-4272· CVE-2025-14986, GHSA-p2gr-hm8g-q772Temporal has a namespace policy bypass allowing requests to be authorized for incorrect contexts in go.temporal.io/server
Modified: 2/4/2026
—Go
GO-2026-4273· CVE-2025-14987, GHSA-hmhp-gh8m-c8xpTemporal has an Incorrect Authorization vulnerability in go.temporal.io/server
Modified: 1/14/2026
—Go
GO-2026-5578· CVE-2026-5724, GHSA-q98v-9f9w-f49qTemporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint in go.temporal.io/server
Modified: 6/25/2026
—Go
GO-2026-5766· CVE-2026-5199, GHSA-xpg8-3hhp-p7w8Temporal Server: attacker-controlled namespace could signal, delete, and reset workflows or activities in a victim namespace on the same cluster in go.temporal.io/server
Modified: 6/25/2026