Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Temporal Server could let attackers bypass controls

published 1 month ago
Summary

The Temporal Server software can be tricked into allowing actions it should block, which could let an attacker gain unauthorized access or manipulate workflows. Updating to the latest version of Temporal Server resolves the issue. Apply the security update as soon as possible.

What to do
  • Update cleanstart temporal-server to version 1.28.4-r2.
  • Update cleanstart temporal-server to version 1.29.7-r2.
  • Update cleanstart temporal-server to version 1.30.5-r1.
  • Update cleanstart temporal-server to version 1.30.6-r1.
  • Update cleanstart temporal-server to version 1.31.1-r5.
Affected software
Ecosystem VendorProductAffected versions
CleanStart cleanstart temporal-server < 1.28.4-r2
< 1.29.7-r2
< 1.30.5-r1
< 1.30.6-r1
< 1.31.1-r5
Fix: upgrade to 1.28.4-r2
Original advisory text
Security fix for CVE-2025-14986 applied in: temporal-server 1.28.4-r2, temporal-server 1.29.7-r2, temporal-server 1.30.5-r1, temporal-server 1.30.6-r1, temporal-server 1.31.1-r5
CVE-2025-14986 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.
References
Timeline
Published18 Sep 2026
Updated18 Sep 2026
First seen18 Sep 2026
Sources
CLEANSTART-2026-NH98703 · OSV
Track software like this
Free during beta