CVE-2026-108126 (GCVE-0-2026-108126)

Vulnerability from cvelistv5 – Published: 2026-10-15 19:09 – Updated: 2026-10-16 15:20
VLAI
Title
temporal-proxy payload decryption is not bound to the request namespace
Summary
temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server's /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified.
Severity
6 (Medium)
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-15 20:04 UTC
CWE
  • CWE-639 - Authorization Bypass Through User-Controlled Key
Assigner
Temporal CNA under the mitre root
CNA scorecard A 97/100 over 13 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Temporal Technologies, Inc. temporal-proxy Affected: 0.2.0 , < 0.9.0 (semver)
guessed Create a notification for this product.
Credits
Reported internally at Temporal Technologies, Inc. Praetorian, who independently reported this issue responsibly to Temporal Technologies
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108126",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T20:04:10.335323Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:20:20.801Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "github.com/temporalio/temporal-proxy",
          "product": "temporal-proxy",
          "programFiles": [
            "pkg/crypto/vault.go",
            "pkg/crypto/kek.go",
            "pkg/crypto/dek.go",
            "pkg/codec/encryptor.go",
            "internal/proxy/encryption.go",
            "internal/codecserver/handler.go"
          ],
          "programRoutines": [
            {
              "name": "Vault.Open"
            },
            {
              "name": "KEKRegistry.Decrypt"
            },
            {
              "name": "DEK.Decrypt"
            },
            {
              "name": "Encryptor.Decode"
            }
          ],
          "repo": "https://github.com/temporalio/temporal-proxy",
          "vendor": "Temporal Technologies, Inc.",
          "versions": [
            {
              "lessThan": "0.9.0",
              "status": "affected",
              "version": "0.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eExploitation requires all of the following. Payload encryption is enabled; it is off by default. Callers are restricted to particular namespaces, either by an authorization extension (0.5.0 and later) or by per-namespace authorization on the upstream Temporal server. The attacker is authorized for one namespace and holds an encrypted payload from another, obtained outside the proxy, for example through read access on the Temporal server, an export, or the persistence store. Either the codec server is enabled (0.8.0 only, off by default), or the attacker can write to their own namespace on the Temporal server directly. In affected versions, the built-in static-token and JWKS authenticators do not restrict callers by namespace, so a deployment that relies on them alone already lets every caller read every namespace through the proxy, and this issue crosses no further boundary there.\u003c/p\u003e"
            }
          ],
          "value": "Exploitation requires all of the following. Payload encryption is enabled; it is off by default. Callers are restricted to particular namespaces, either by an authorization extension (0.5.0 and later) or by per-namespace authorization on the upstream Temporal server. The attacker is authorized for one namespace and holds an encrypted payload from another, obtained outside the proxy, for example through read access on the Temporal server, an export, or the persistence store. Either the codec server is enabled (0.8.0 only, off by default), or the attacker can write to their own namespace on the Temporal server directly. In affected versions, the built-in static-token and JWKS authenticators do not restrict callers by namespace, so a deployment that relies on them alone already lets every caller read every namespace through the proxy, and this issue crosses no further boundary there."
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Attack Requirements metric is Present because the attacker must obtain the encrypted payload from a source other than the proxy, such as the Temporal server or its storage, which are the parties proxy encryption is meant to keep from plaintext.\u003c/p\u003e"
            }
          ],
          "value": "The Attack Requirements metric is Present because the attacker must obtain the encrypted payload from a source other than the proxy, such as the Temporal server or its storage, which are the parties proxy encryption is meant to keep from plaintext."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Reported internally at Temporal Technologies, Inc."
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Praetorian, who independently reported this issue responsibly to Temporal Technologies"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003etemporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server\u0027s /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified.\u003c/p\u003e"
            }
          ],
          "value": "temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server\u0027s /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Disclosure, across the namespace authorization boundary, of payloads the proxy encrypted: Workflow and Activity inputs and results, and Signal and Update arguments. Encrypted payloads cannot be modified through this issue, and data the proxy does not encrypt is not affected. No availability impact was identified."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T19:09:30.743Z",
        "orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
        "shortName": "Temporal"
      },
      "references": [
        {
          "name": "Vault.Open in temporal-proxy 0.8.0, which takes no namespace",
          "tags": [
            "product"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/vault.go#L256"
        },
        {
          "name": "KEKRegistry.Decrypt in temporal-proxy 0.8.0, which selects the KEK by the identifier in the payload",
          "tags": [
            "product"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/kek.go#L172-L180"
        },
        {
          "name": "AES-256-GCM sealed and opened with no associated data in temporal-proxy 0.8.0",
          "tags": [
            "product"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/dek.go#L54-L67"
        },
        {
          "name": "Design discussion of associated data in the payload encryption scheme",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/discussions/146"
        },
        {
          "name": "Fix pull request",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/pull/221"
        },
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/commit/6843a2c4626aa2c7f00fbf54e4e9fa98f6254f07"
        },
        {
          "name": "Codec server fix pull request",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/pull/222"
        },
        {
          "name": "Codec server fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/commit/508991c298b9ac31915dd7349ffa88d79fad3475"
        },
        {
          "name": "temporal-proxy 0.9.0",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/releases/tag/v0.9.0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to temporal-proxy 0.9.0 or later and set encryption.namespaceBinding to strict. Fixed releases record the namespace in each payload they encrypt and, in strict mode, refuse to decrypt a payload recorded for another namespace or for none, including through the codec server\u0027s /decode endpoint, which then requires the caller to name a namespace. The setting has no default and must be set whenever encryption keys are configured. The off and permissive modes exist to migrate payloads encrypted by earlier releases, which carry no namespace, and do not close this issue; move to strict once the vault_unbound_opens_total and vault_namespace_mismatches_total metrics have stayed at zero for longer than namespace retention. Payloads carried in Nexus operations are not compared, because they cross namespaces by design.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to temporal-proxy 0.9.0 or later and set encryption.namespaceBinding to strict. Fixed releases record the namespace in each payload they encrypt and, in strict mode, refuse to decrypt a payload recorded for another namespace or for none, including through the codec server\u0027s /decode endpoint, which then requires the caller to name a namespace. The setting has no default and must be set whenever encryption keys are configured. The off and permissive modes exist to migrate payloads encrypted by earlier releases, which carry no namespace, and do not close this issue; move to strict once the vault_unbound_opens_total and vault_namespace_mismatches_total metrics have stayed at zero for longer than namespace retention. Payloads carried in Nexus operations are not compared, because they cross namespaces by design."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "temporal-proxy payload decryption is not bound to the request namespace",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUntil a fixed release is deployed, serve namespaces that must stay isolated from each other through separate proxy deployments, or use KMS key policies that let each proxy use only the keys of the namespaces it serves. Giving each namespace its own key on a single proxy does not help, because that proxy holds all of them. Leaving the codec server disabled closes the /decode route only.\u003c/p\u003e"
            }
          ],
          "value": "Until a fixed release is deployed, serve namespaces that must stay isolated from each other through separate proxy deployments, or use KMS key policies that let each proxy use only the keys of the namespaces it serves. Giving each namespace its own key on a single proxy does not help, because that proxy holds all of them. Leaving the codec server disabled closes the /decode route only."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
    "assignerShortName": "Temporal",
    "cveId": "CVE-2026-108126",
    "datePublished": "2026-10-15T19:09:30.743Z",
    "dateReserved": "2026-10-09T14:47:54.417Z",
    "dateUpdated": "2026-10-16T15:20:20.801Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-108126",
      "date": "2026-10-17",
      "epss": "0.00356",
      "percentile": "0.27764"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "collectionURL": "https://pkg.go.dev",
                "defaultStatus": "unaffected",
                "packageName": "github.com/temporalio/temporal-proxy",
                "product": "temporal-proxy",
                "programFiles": [
                  "pkg/crypto/vault.go",
                  "pkg/crypto/kek.go",
                  "pkg/crypto/dek.go",
                  "pkg/codec/encryptor.go",
                  "internal/proxy/encryption.go",
                  "internal/codecserver/handler.go"
                ],
                "programRoutines": [
                  {
                    "name": "Vault.Open"
                  },
                  {
                    "name": "KEKRegistry.Decrypt"
                  },
                  {
                    "name": "DEK.Decrypt"
                  },
                  {
                    "name": "Encryptor.Decode"
                  }
                ],
                "repo": "https://github.com/temporalio/temporal-proxy",
                "vendor": "Temporal Technologies, Inc.",
                "versions": [
                  {
                    "lessThan": "0.9.0",
                    "status": "affected",
                    "version": "0.2.0",
                    "versionType": "semver"
                  }
                ]
              }
            ],
            "source": "security@temporal.io"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server\u0027s /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified."
          }
        ],
        "id": "CVE-2026-108126",
        "lastModified": "2026-10-16T19:55:59.740",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.0,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security@temporal.io",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-108126",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T20:04:10.335323Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-15T19:17:19.873",
        "references": [
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/dek.go#L54-L67"
          },
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/kek.go#L172-L180"
          },
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/vault.go#L256"
          },
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal-proxy/commit/508991c298b9ac31915dd7349ffa88d79fad3475"
          },
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal-proxy/commit/6843a2c4626aa2c7f00fbf54e4e9fa98f6254f07"
          },
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal-proxy/discussions/146"
          },
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal-proxy/pull/221"
          },
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal-proxy/pull/222"
          },
          {
            "source": "security@temporal.io",
            "url": "https://github.com/temporalio/temporal-proxy/releases/tag/v0.9.0"
          }
        ],
        "sourceIdentifier": "security@temporal.io",
        "vulnStatus": "Awaiting Analysis",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-639"
              }
            ],
            "source": "security@temporal.io",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-108126",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-15T20:04:10.335323Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-16T15:11:45.651Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "collectionURL": "https://pkg.go.dev",
              "defaultStatus": "unaffected",
              "packageName": "github.com/temporalio/temporal-proxy",
              "product": "temporal-proxy",
              "programFiles": [
                "pkg/crypto/vault.go",
                "pkg/crypto/kek.go",
                "pkg/crypto/dek.go",
                "pkg/codec/encryptor.go",
                "internal/proxy/encryption.go",
                "internal/codecserver/handler.go"
              ],
              "programRoutines": [
                {
                  "name": "Vault.Open"
                },
                {
                  "name": "KEKRegistry.Decrypt"
                },
                {
                  "name": "DEK.Decrypt"
                },
                {
                  "name": "Encryptor.Decode"
                }
              ],
              "repo": "https://github.com/temporalio/temporal-proxy",
              "vendor": "Temporal Technologies, Inc.",
              "versions": [
                {
                  "lessThan": "0.9.0",
                  "status": "affected",
                  "version": "0.2.0",
                  "versionType": "semver"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eExploitation requires all of the following. Payload encryption is enabled; it is off by default. Callers are restricted to particular namespaces, either by an authorization extension (0.5.0 and later) or by per-namespace authorization on the upstream Temporal server. The attacker is authorized for one namespace and holds an encrypted payload from another, obtained outside the proxy, for example through read access on the Temporal server, an export, or the persistence store. Either the codec server is enabled (0.8.0 only, off by default), or the attacker can write to their own namespace on the Temporal server directly. In affected versions, the built-in static-token and JWKS authenticators do not restrict callers by namespace, so a deployment that relies on them alone already lets every caller read every namespace through the proxy, and this issue crosses no further boundary there.\u003c/p\u003e"
                }
              ],
              "value": "Exploitation requires all of the following. Payload encryption is enabled; it is off by default. Callers are restricted to particular namespaces, either by an authorization extension (0.5.0 and later) or by per-namespace authorization on the upstream Temporal server. The attacker is authorized for one namespace and holds an encrypted payload from another, obtained outside the proxy, for example through read access on the Temporal server, an export, or the persistence store. Either the codec server is enabled (0.8.0 only, off by default), or the attacker can write to their own namespace on the Temporal server directly. In affected versions, the built-in static-token and JWKS authenticators do not restrict callers by namespace, so a deployment that relies on them alone already lets every caller read every namespace through the proxy, and this issue crosses no further boundary there."
            },
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eThe Attack Requirements metric is Present because the attacker must obtain the encrypted payload from a source other than the proxy, such as the Temporal server or its storage, which are the parties proxy encryption is meant to keep from plaintext.\u003c/p\u003e"
                }
              ],
              "value": "The Attack Requirements metric is Present because the attacker must obtain the encrypted payload from a source other than the proxy, such as the Temporal server or its storage, which are the parties proxy encryption is meant to keep from plaintext."
            }
          ],
          "credits": [
            {
              "lang": "en",
              "type": "finder",
              "value": "Reported internally at Temporal Technologies, Inc."
            },
            {
              "lang": "en",
              "type": "finder",
              "value": "Praetorian, who independently reported this issue responsibly to Temporal Technologies"
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003etemporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server\u0027s /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified.\u003c/p\u003e"
                }
              ],
              "value": "temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server\u0027s /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "Disclosure, across the namespace authorization boundary, of payloads the proxy encrypted: Workflow and Activity inputs and results, and Signal and Update arguments. Encrypted payloads cannot be modified through this issue, and data the proxy does not encrypt is not affected. No availability impact was identified."
                }
              ]
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "PRESENT",
                "attackVector": "NETWORK",
                "baseScore": 6,
                "baseSeverity": "MEDIUM",
                "exploitMaturity": "NOT_DEFINED",
                "privilegesRequired": "LOW",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "format": "CVSS",
              "scenarios": [
                {
                  "lang": "en",
                  "value": "GENERAL"
                }
              ]
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-639",
                  "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-15T19:09:30.743Z",
            "orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
            "shortName": "Temporal"
          },
          "references": [
            {
              "name": "Vault.Open in temporal-proxy 0.8.0, which takes no namespace",
              "tags": [
                "product"
              ],
              "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/vault.go#L256"
            },
            {
              "name": "KEKRegistry.Decrypt in temporal-proxy 0.8.0, which selects the KEK by the identifier in the payload",
              "tags": [
                "product"
              ],
              "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/kek.go#L172-L180"
            },
            {
              "name": "AES-256-GCM sealed and opened with no associated data in temporal-proxy 0.8.0",
              "tags": [
                "product"
              ],
              "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/dek.go#L54-L67"
            },
            {
              "name": "Design discussion of associated data in the payload encryption scheme",
              "tags": [
                "technical-description"
              ],
              "url": "https://github.com/temporalio/temporal-proxy/discussions/146"
            },
            {
              "name": "Fix pull request",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/temporalio/temporal-proxy/pull/221"
            },
            {
              "name": "Fix commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/temporalio/temporal-proxy/commit/6843a2c4626aa2c7f00fbf54e4e9fa98f6254f07"
            },
            {
              "name": "Codec server fix pull request",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/temporalio/temporal-proxy/pull/222"
            },
            {
              "name": "Codec server fix commit",
              "tags": [
                "patch"
              ],
              "url": "https://github.com/temporalio/temporal-proxy/commit/508991c298b9ac31915dd7349ffa88d79fad3475"
            },
            {
              "name": "temporal-proxy 0.9.0",
              "tags": [
                "release-notes"
              ],
              "url": "https://github.com/temporalio/temporal-proxy/releases/tag/v0.9.0"
            }
          ],
          "solutions": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eUpgrade to temporal-proxy 0.9.0 or later and set encryption.namespaceBinding to strict. Fixed releases record the namespace in each payload they encrypt and, in strict mode, refuse to decrypt a payload recorded for another namespace or for none, including through the codec server\u0027s /decode endpoint, which then requires the caller to name a namespace. The setting has no default and must be set whenever encryption keys are configured. The off and permissive modes exist to migrate payloads encrypted by earlier releases, which carry no namespace, and do not close this issue; move to strict once the vault_unbound_opens_total and vault_namespace_mismatches_total metrics have stayed at zero for longer than namespace retention. Payloads carried in Nexus operations are not compared, because they cross namespaces by design.\u003c/p\u003e"
                }
              ],
              "value": "Upgrade to temporal-proxy 0.9.0 or later and set encryption.namespaceBinding to strict. Fixed releases record the namespace in each payload they encrypt and, in strict mode, refuse to decrypt a payload recorded for another namespace or for none, including through the codec server\u0027s /decode endpoint, which then requires the caller to name a namespace. The setting has no default and must be set whenever encryption keys are configured. The off and permissive modes exist to migrate payloads encrypted by earlier releases, which carry no namespace, and do not close this issue; move to strict once the vault_unbound_opens_total and vault_namespace_mismatches_total metrics have stayed at zero for longer than namespace retention. Payloads carried in Nexus operations are not compared, because they cross namespaces by design."
            }
          ],
          "source": {
            "discovery": "INTERNAL"
          },
          "title": "temporal-proxy payload decryption is not bound to the request namespace",
          "workarounds": [
            {
              "lang": "en",
              "supportingMedia": [
                {
                  "base64": false,
                  "type": "text/html",
                  "value": "\u003cp\u003eUntil a fixed release is deployed, serve namespaces that must stay isolated from each other through separate proxy deployments, or use KMS key policies that let each proxy use only the keys of the namespaces it serves. Giving each namespace its own key on a single proxy does not help, because that proxy holds all of them. Leaving the codec server disabled closes the /decode route only.\u003c/p\u003e"
                }
              ],
              "value": "Until a fixed release is deployed, serve namespaces that must stay isolated from each other through separate proxy deployments, or use KMS key policies that let each proxy use only the keys of the namespaces it serves. Giving each namespace its own key on a single proxy does not help, because that proxy holds all of them. Leaving the codec server disabled closes the /decode route only."
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
        "assignerShortName": "Temporal",
        "cveId": "CVE-2026-108126",
        "datePublished": "2026-10-15T19:09:30.743Z",
        "dateReserved": "2026-10-09T14:47:54.417Z",
        "dateUpdated": "2026-10-15T19:09:30.743Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.