{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87857",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-12T16:49:08.520166Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-12T16:49:29.027Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "cpes": [
            "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Frontend",
            "History"
          ],
          "packageName": "go.temporal.io/server",
          "product": "Temporal Server",
          "programFiles": [
            "proto/internal/temporal/server/api/token/v1/message.proto",
            "service/history/api/token.go",
            "service/history/api/get_history_util.go",
            "service/history/api/getworkflowexecutionhistory/api.go",
            "service/history/api/getworkflowexecutionhistoryreverse/api.go"
          ],
          "programRoutines": [
            {
              "name": "getworkflowexecutionhistory.Invoke"
            },
            {
              "name": "getworkflowexecutionhistoryreverse.Invoke"
            },
            {
              "name": "api.DeserializeHistoryToken"
            },
            {
              "name": "api.GetHistory"
            },
            {
              "name": "api.GetHistoryReverse"
            }
          ],
          "repo": "https://github.com/temporalio/temporal",
          "vendor": "Temporal Technologies, Inc.",
          "versions": [
            {
              "lessThan": "1.0.0",
              "status": "unknown",
              "version": "0.0.0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "1.29.7",
              "status": "affected",
              "version": "1.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.30.7",
              "status": "affected",
              "version": "1.30.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.31.3",
              "status": "affected",
              "version": "1.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eExploitation requires a genuine non-final history continuation previously issued for a workflow in the target namespace, obtained through the caller\u0027s own earlier authorized access or through another disclosure of that token. A continuation cannot be constructed from a namespace, workflow, and run identifier alone, because the branch token carries randomly assigned persisted tree and branch identity. Aligning the request\u0027s workflow identifier with the continuation\u0027s History shard is caller-controlled and can be retried until it succeeds, and no workflow with that identifier need exist, so shard alignment is not an attack requirement.\u003c/p\u003e"
            }
          ],
          "value": "Exploitation requires a genuine non-final history continuation previously issued for a workflow in the target namespace, obtained through the caller\u0027s own earlier authorized access or through another disclosure of that token. A continuation cannot be constructed from a namespace, workflow, and run identifier alone, because the branch token carries randomly assigned persisted tree and branch identity. Aligning the request\u0027s workflow identifier with the continuation\u0027s History shard is caller-controlled and can be retried until it succeeds, and no workflow with that identifier need exist, so shard alignment is not an attack requirement."
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe CVSS Base score describes a deployment that configures authentication and authorization, which is the supported secure self-hosted posture. In self-hosted Temporal Server these are operator-configured rather than enabled by default; a deployment that configures no Authorizer already permits every namespace read, and this is not the boundary that fails there. The privileges-required assessment reflects a caller holding read permission on one namespace under a configured Authorizer. Namespaces are an isolation boundary in single-organization deployments as well as multi-organization ones, commonly separating environments such as production from staging or one team\u0027s workloads from another\u0027s, and the Base score reflects the loss of that boundary without assuming multiple tenants.\u003c/p\u003e"
            }
          ],
          "value": "The CVSS Base score describes a deployment that configures authentication and authorization, which is the supported secure self-hosted posture. In self-hosted Temporal Server these are operator-configured rather than enabled by default; a deployment that configures no Authorizer already permits every namespace read, and this is not the boundary that fails there. The privileges-required assessment reflects a caller holding read permission on one namespace under a configured Authorizer. Namespaces are an isolation boundary in single-organization deployments as well as multi-organization ones, commonly separating environments such as production from staging or one team\u0027s workloads from another\u0027s, and the Base score reflects the loss of that boundary without assuming multiple tenants."
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe confidentiality assessment reflects a bounded loss rather than a total one. A caller reaches only those workflows for which they hold a genuine non-final continuation, and cannot enumerate other workflows in the disclosed namespace. Within a reachable workflow the disclosure is not bounded to the page already seen, because the token\u0027s event range can be advanced. Whether the disclosed history is itself gravely sensitive depends on the application: without a Payload Codec, workflow arguments, signal payloads, and results may be readable in full, and where a Codec is correctly deployed the covered payload bodies remain ciphertext while history metadata such as event types and timing, workflow and signal type names, task queues, retry and timeout configuration, identities, search attributes, and default failure messages and stack traces are still disclosed. Deployments should apply Environmental metrics, in particular a Confidentiality Requirement, to reflect the sensitivity of the workflow data they run.\u003c/p\u003e"
            }
          ],
          "value": "The confidentiality assessment reflects a bounded loss rather than a total one. A caller reaches only those workflows for which they hold a genuine non-final continuation, and cannot enumerate other workflows in the disclosed namespace. Within a reachable workflow the disclosure is not bounded to the page already seen, because the token\u0027s event range can be advanced. Whether the disclosed history is itself gravely sensitive depends on the application: without a Payload Codec, workflow arguments, signal payloads, and results may be readable in full, and where a Codec is correctly deployed the covered payload bodies remain ciphertext while history metadata such as event types and timing, workflow and signal type names, task queues, retry and timeout configuration, identities, search attributes, and default failure messages and stack traces are still disclosed. Deployments should apply Environmental metrics, in particular a Confidentiality Requirement, to reflect the sensitivity of the workflow data they run."
        },
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eFixed releases gate the check on two dynamic configuration settings. history.enablePaginationTokenBranchValidation defaults to true and history.enablePaginationTokenBranchValidationShadowMode defaults to false, so a fixed release enforces the check without operator action. Two operator changes restore the vulnerable behavior, by different routes: setting history.enablePaginationTokenBranchValidationShadowMode to true keeps the check running and keeps recording the mismatch, but serves the read anyway, while setting history.enablePaginationTokenBranchValidation to false skips the check entirely and records nothing. Rejection of a page token that carries no branch token at all is not gated by shadow mode. Enforcement rejects a page token whose branch token is a retained but non-current branch of the requested execution, reported as reason=non_current_branch, which can interrupt legitimate in-flight pagination after conflict resolution or failover; operators who encounter that condition should treat the settings as a temporary measure and accept the disclosure risk for its duration.\u003c/p\u003e"
            }
          ],
          "value": "Fixed releases gate the check on two dynamic configuration settings. history.enablePaginationTokenBranchValidation defaults to true and history.enablePaginationTokenBranchValidationShadowMode defaults to false, so a fixed release enforces the check without operator action. Two operator changes restore the vulnerable behavior, by different routes: setting history.enablePaginationTokenBranchValidationShadowMode to true keeps the check running and keeps recording the mismatch, but serves the read anyway, while setting history.enablePaginationTokenBranchValidation to false skips the check entirely and records nothing. Rejection of a page token that carries no branch token at all is not gated by shadow mode. Enforcement rejects a page token whose branch token is a retained but non-current branch of the requested execution, reported as reason=non_current_branch, which can interrupt legitimate in-flight pagination after conflict resolution or failover; operators who encounter that condition should treat the settings as a temporary measure and accept the disclosure risk for its duration."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Reported internally at Temporal Technologies, Inc."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eTemporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace\u0027s workflow history, provided the supplied workflow identifier selects the same History shard as the continuation\u0027s branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller\u0027s current credential no longer granted access to the continuation\u0027s namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token\u0027s branch token is not the requested execution\u0027s current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading \"Pagination branch token is not the execution\u0027s current branch token\" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state.\u003c/p\u003e"
            }
          ],
          "value": "Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace\u0027s workflow history, provided the supplied workflow identifier selects the same History shard as the continuation\u0027s branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller\u0027s current credential no longer granted access to the continuation\u0027s namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token\u0027s branch token is not the requested execution\u0027s current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading \"Pagination branch token is not the execution\u0027s current branch token\" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Disclosure of workflow history across the namespace authorization boundary. The disclosure persists after the caller\u0027s credential stops granting access to that namespace and covers history events created after that point, so revoking the caller\u0027s access does not end it. No integrity or availability impact was identified."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-639",
              "description": "CWE-639: Authorization Bypass Through User-Controlled Key",
              "lang": "en",
              "type": "CWE"
            },
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-09T19:45:14.927Z",
        "orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
        "shortName": "Temporal"
      },
      "references": [
        {
          "name": "Earliest source-confirmed affected release",
          "tags": [
            "product"
          ],
          "url": "https://github.com/temporalio/temporal/blob/v1.0.0/service/frontend/workflowHandler.go#L602-L740"
        },
        {
          "name": "Fix pull request",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/pull/11723"
        },
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/commit/ceb1cc1071b1fd37f8a2cd8ef5ed3e4333245cc2"
        },
        {
          "name": "Backport pull request for the 1.32 release line",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/pull/11919"
        },
        {
          "name": "Backport commit on release/v1.32.x",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/commit/4b02728735450dd60eaff9a5d0dc8e11fc8a4b13"
        },
        {
          "name": "Backport pull request for the 1.31 release line",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/pull/12039"
        },
        {
          "name": "Backport commit on release/v1.31.x",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/commit/c82a2d228e7287b1d283a55477f40a1a48481010"
        },
        {
          "name": "Backport pull request for the 1.30 release line",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/pull/12040"
        },
        {
          "name": "Backport commit on release/v1.30.x",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/commit/690b53103e11982de5f9187f722a0e0d3780028d"
        },
        {
          "name": "Temporal Server 1.30.7",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
        },
        {
          "name": "Temporal Server 1.31.3",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
        },
        {
          "name": "Temporal Server 1.32.0",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.32.0"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and leave history.enablePaginationTokenBranchValidation at its default of true and history.enablePaginationTokenBranchValidationShadowMode at its default of false. The fix loads mutable state for the namespace and workflow named in the authorized request together with the run identifier from the page token, requires the token\u0027s branch token to equal that execution\u0027s current branch token, and rejects the request before any history persistence read. It covers the forward decoded, forward raw, and reverse history paths; the forward long-poll refresh path independently replaces the caller\u0027s branch token with the authorized execution\u0027s current branch token before reading history. Temporal Server releases up to and including 1.29.7 are outside the supported window and receive no fix; operators on those releases should upgrade to a supported line.\u003c/p\u003e"
            }
          ],
          "value": "Upgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and leave history.enablePaginationTokenBranchValidation at its default of true and history.enablePaginationTokenBranchValidationShadowMode at its default of false. The fix loads mutable state for the namespace and workflow named in the authorized request together with the run identifier from the page token, requires the token\u0027s branch token to equal that execution\u0027s current branch token, and rejects the request before any history persistence read. It covers the forward decoded, forward raw, and reverse history paths; the forward long-poll refresh path independently replaces the caller\u0027s branch token with the authorized execution\u0027s current branch token before reading history. Temporal Server releases up to and including 1.29.7 are outside the supported window and receive no fix; operators on those releases should upgrade to a supported line."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Temporal Server workflow-history pagination token is not bound to the requested namespace and workflow",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eNo setting in an affected release closes this issue, because the binding check does not exist there. Until upgrading, limit exposure by granting namespace read permission only to principals trusted with every namespace they can reach, revoking and reissuing credentials through a mechanism that does not leave prior pagination state usable, treating history page tokens as sensitive and keeping them out of application logs, traces, error reports, and shared storage, and reducing namespace retention so that a referenced history branch becomes unavailable sooner after a workflow closes. A Payload Codec reduces the sensitivity of disclosed payload bodies but does not prevent the unauthorized read or protect history metadata. A long-running open workflow can outlive its namespace\u0027s closed-execution retention duration, because that duration is measured from workflow closure.\u003c/p\u003e"
            }
          ],
          "value": "No setting in an affected release closes this issue, because the binding check does not exist there. Until upgrading, limit exposure by granting namespace read permission only to principals trusted with every namespace they can reach, revoking and reissuing credentials through a mechanism that does not leave prior pagination state usable, treating history page tokens as sensitive and keeping them out of application logs, traces, error reports, and shared storage, and reducing namespace retention so that a referenced history branch becomes unavailable sooner after a workflow closes. A Payload Codec reduces the sensitivity of disclosed payload bodies but does not prevent the unauthorized read or protect history metadata. A long-running open workflow can outlive its namespace\u0027s closed-execution retention duration, because that duration is measured from workflow closure."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
    "assignerShortName": "Temporal",
    "cveId": "CVE-2026-87857",
    "datePublished": "2026-11-09T19:45:14.927Z",
    "dateReserved": "2026-09-09T13:05:41.629Z",
    "dateUpdated": "2026-11-12T16:49:29.027Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}