CVE-2026-120091 in Server
Summary
by MITRE • 11/02/2026
Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller's request rather than from operator configuration, and building and using that client could run a command of the caller's choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line does not include the Worker Controller Instance module and is unaffected. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is in an affected range. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective value of workercontroller.compute_providers.enabled contains k8s, or, on 1.31.0 through 1.31.2 only, is unset; check both the global value and every namespace-constrained override, because an override can add k8s for a single namespace. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Deployments that use a custom authorizer should also check whether it permits ValidateWorkerDeploymentVersionComputeConfig to callers without namespace write access. The separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path on any affected release.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability in question involves a critical authorization bypass and command injection flaw within the Temporal Server's Worker Controller Instance module, specifically affecting versions 1.31.0 through 1.32.x where the k8s compute provider is enabled or left as default on older releases. This issue stems from how the Kubernetes client for managing workers running in a cluster is constructed. Instead of relying on operator-supplied configuration that adheres to strict security boundaries, the system builds this client using parameters directly supplied by the caller's request. This architectural decision allows an authenticated user with only read-only permissions in a single namespace to execute arbitrary commands on the Worker Service host under the privileges of the server process account. The attack vector is particularly dangerous because it does not require complex sequences or specific scaling events; rather, it can be triggered through standard frontend operations such as ValidateWorkerDeploymentVersionComputeConfig, which is ostensibly designed for read-only validation but inadvertently exposes the underlying command execution capability during configuration validation.
From a technical perspective, this vulnerability represents a severe failure in input validation and privilege separation, aligning with CWE-78 Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) and CWE-269 Improvement of Privilege Control regarding unauthorized access to system resources. The core issue lies in the dynamic configuration setting workercontroller.compute_providers.enabled which acts as a gatekeeper for compute providers. In Temporal Server versions 1.31.0 through 1.31.2, this allowlist does not deny by default; if the setting is unset, every registered provider including k8s is permitted without restriction. This means that out-of-the-box deployments of these specific releases are inherently vulnerable provided they have authorization configured to enforce namespace boundaries. For versions 1.31.3 and later within the 1.31 line, as well as all 1.32.0 and later releases, the default behavior shifts to deny-by-default, meaning exposure only occurs if an administrator explicitly adds k8s to the allowlist. The vulnerability is further exacerbated by the fact that the Worker Service process holds persistence credentials for every namespace in the cluster along with its TLS material, allowing lateral movement beyond the caller's initial namespace boundary when exploited successfully.
The operational impact of this flaw extends far beyond simple data exfiltration or denial of service. Because the attacker can execute commands on the host machine running the Temporal Worker Service, they effectively gain control over the underlying infrastructure associated with that deployment. This includes access to cluster-wide secrets and certificates stored by the service process. The attack path is accessible via any frontend operation that reaches the k8s provider, but notably does not require a worker deployment to already exist, lowering the barrier for exploitation significantly. Furthermore, while there is a separate per-namespace dynamic configuration setting called workercontroller.enabled intended to gate functionality, it does not restrict access to this specific vulnerable code path on affected releases. Therefore, even if general worker controller features are disabled at the namespace level, the validation endpoint remains reachable and exploitable if authorization mechanisms are in place that allow read-only users to invoke these validation routines without write privileges.
Mitigation strategies must focus on both immediate configuration changes and long-term architectural improvements. Administrators running affected versions should immediately verify their dynamic configuration settings. For deployments using Temporal Server 1.31.0 through 1.31.2, it is critical to explicitly set workercontroller.compute_providers.enabled to an empty list or a whitelist that excludes k8s if Kubernetes-based scaling is not strictly required and cannot be secured otherwise. For newer versions where the default is deny-by-default, administrators must audit their allowlists to ensure k8s has not been inadvertently added unless absolutely necessary. Additionally, organizations should review their authorization configurations to confirm whether custom authorizers permit ValidateWorkerDeploymentVersionComputeConfig for users lacking namespace write access; if so, these permissions should be revoked or restricted. From a broader security posture perspective, this incident highlights the importance of adhering to the principle of least privilege in API design and ensuring that read-only operations do not inadvertently trigger privileged backend processes. Implementing strict input sanitization and avoiding direct construction of sensitive clients from user-supplied data are essential practices to prevent similar command injection vulnerabilities in future iterations of distributed systems like Temporal Server.