{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-108126",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T20:04:10.335323Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-16T15:20:20.801Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "github.com/temporalio/temporal-proxy",
          "product": "temporal-proxy",
          "programFiles": [
            "pkg/crypto/vault.go",
            "pkg/crypto/kek.go",
            "pkg/crypto/dek.go",
            "pkg/codec/encryptor.go",
            "internal/proxy/encryption.go",
            "internal/codecserver/handler.go"
          ],
          "programRoutines": [
            {
              "name": "Vault.Open"
            },
            {
              "name": "KEKRegistry.Decrypt"
            },
            {
              "name": "DEK.Decrypt"
            },
            {
              "name": "Encryptor.Decode"
            }
          ],
          "repo": "https://github.com/temporalio/temporal-proxy",
          "vendor": "Temporal Technologies, Inc.",
          "versions": [
            {
              "lessThan": "0.9.0",
              "status": "affected",
              "version": "0.2.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eExploitation requires all of the following. Payload encryption is enabled; it is off by default. Callers are restricted to particular namespaces, either by an authorization extension (0.5.0 and later) or by per-namespace authorization on the upstream Temporal server. The attacker is authorized for one namespace and holds an encrypted payload from another, obtained outside the proxy, for example through read access on the Temporal server, an export, or the persistence store. Either the codec server is enabled (0.8.0 only, off by default), or the attacker can write to their own namespace on the Temporal server directly. In affected versions, the built-in static-token and JWKS authenticators do not restrict callers by namespace, so a deployment that relies on them alone already lets every caller read every namespace through the proxy, and this issue crosses no further boundary there.\u003c/p\u003e"
            }
          ],
          "value": "Exploitation requires all of the following. Payload encryption is enabled; it is off by default. Callers are restricted to particular namespaces, either by an authorization extension (0.5.0 and later) or by per-namespace authorization on the upstream Temporal server. The attacker is authorized for one namespace and holds an encrypted payload from another, obtained outside the proxy, for example through read access on the Temporal server, an export, or the persistence store. Either the codec server is enabled (0.8.0 only, off by default), or the attacker can write to their own namespace on the Temporal server directly. In affected versions, the built-in static-token and JWKS authenticators do not restrict callers by namespace, so a deployment that relies on them alone already lets every caller read every namespace through the proxy, and this issue crosses no further boundary there."
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe Attack Requirements metric is Present because the attacker must obtain the encrypted payload from a source other than the proxy, such as the Temporal server or its storage, which are the parties proxy encryption is meant to keep from plaintext.\u003c/p\u003e"
            }
          ],
          "value": "The Attack Requirements metric is Present because the attacker must obtain the encrypted payload from a source other than the proxy, such as the Temporal server or its storage, which are the parties proxy encryption is meant to keep from plaintext."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Reported internally at Temporal Technologies, Inc."
        },
        {
          "lang": "en",
          "type": "finder",
          "value": "Praetorian, who independently reported this issue responsibly to Temporal Technologies"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003etemporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server\u0027s /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified.\u003c/p\u003e"
            }
          ],
          "value": "temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server\u0027s /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Disclosure, across the namespace authorization boundary, of payloads the proxy encrypted: Workflow and Activity inputs and results, and Signal and Update arguments. Encrypted payloads cannot be modified through this issue, and data the proxy does not encrypt is not affected. No availability impact was identified."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 6,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T19:09:30.743Z",
        "orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
        "shortName": "Temporal"
      },
      "references": [
        {
          "name": "Vault.Open in temporal-proxy 0.8.0, which takes no namespace",
          "tags": [
            "product"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/vault.go#L256"
        },
        {
          "name": "KEKRegistry.Decrypt in temporal-proxy 0.8.0, which selects the KEK by the identifier in the payload",
          "tags": [
            "product"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/kek.go#L172-L180"
        },
        {
          "name": "AES-256-GCM sealed and opened with no associated data in temporal-proxy 0.8.0",
          "tags": [
            "product"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/blob/v0.8.0/pkg/crypto/dek.go#L54-L67"
        },
        {
          "name": "Design discussion of associated data in the payload encryption scheme",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/discussions/146"
        },
        {
          "name": "Fix pull request",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/pull/221"
        },
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/commit/6843a2c4626aa2c7f00fbf54e4e9fa98f6254f07"
        },
        {
          "name": "Codec server fix pull request",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/pull/222"
        },
        {
          "name": "Codec server fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/commit/508991c298b9ac31915dd7349ffa88d79fad3475"
        },
        {
          "name": "temporal-proxy 0.9.0",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/temporalio/temporal-proxy/releases/tag/v0.9.0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to temporal-proxy 0.9.0 or later and set encryption.namespaceBinding to strict. Fixed releases record the namespace in each payload they encrypt and, in strict mode, refuse to decrypt a payload recorded for another namespace or for none, including through the codec server\u0027s /decode endpoint, which then requires the caller to name a namespace. The setting has no default and must be set whenever encryption keys are configured. The off and permissive modes exist to migrate payloads encrypted by earlier releases, which carry no namespace, and do not close this issue; move to strict once the vault_unbound_opens_total and vault_namespace_mismatches_total metrics have stayed at zero for longer than namespace retention. Payloads carried in Nexus operations are not compared, because they cross namespaces by design.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to temporal-proxy 0.9.0 or later and set encryption.namespaceBinding to strict. Fixed releases record the namespace in each payload they encrypt and, in strict mode, refuse to decrypt a payload recorded for another namespace or for none, including through the codec server\u0027s /decode endpoint, which then requires the caller to name a namespace. The setting has no default and must be set whenever encryption keys are configured. The off and permissive modes exist to migrate payloads encrypted by earlier releases, which carry no namespace, and do not close this issue; move to strict once the vault_unbound_opens_total and vault_namespace_mismatches_total metrics have stayed at zero for longer than namespace retention. Payloads carried in Nexus operations are not compared, because they cross namespaces by design."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "temporal-proxy payload decryption is not bound to the request namespace",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUntil a fixed release is deployed, serve namespaces that must stay isolated from each other through separate proxy deployments, or use KMS key policies that let each proxy use only the keys of the namespaces it serves. Giving each namespace its own key on a single proxy does not help, because that proxy holds all of them. Leaving the codec server disabled closes the /decode route only.\u003c/p\u003e"
            }
          ],
          "value": "Until a fixed release is deployed, serve namespaces that must stay isolated from each other through separate proxy deployments, or use KMS key policies that let each proxy use only the keys of the namespaces it serves. Giving each namespace its own key on a single proxy does not help, because that proxy holds all of them. Leaving the codec server disabled closes the /decode route only."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
    "assignerShortName": "Temporal",
    "cveId": "CVE-2026-108126",
    "datePublished": "2026-10-15T19:09:30.743Z",
    "dateReserved": "2026-10-09T14:47:54.417Z",
    "dateUpdated": "2026-10-16T15:20:20.801Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}