CVE-2026-16652 in Server
Summary
by MITRE • 09/21/2026
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/21/2026
The vulnerability identified in Temporal Server represents a significant resource exhaustion flaw rooted in unbounded computational work during schedule evaluation cycles. Specifically, the defect lies within the logic responsible for determining the next action time for a Schedule entity. When processing schedules that combine fine-grained cadences with exclusion calendars designed to reject every candidate time, the server fails to implement an effective per-search work budget. This architectural oversight allows authenticated callers possessing namespace write permissions to construct malicious schedule configurations that force the system into infinite or excessively long evaluation loops without termination criteria based on computational effort expended.
From a technical perspective, this flaw manifests as a denial of service condition affecting both availability and operational stability. The immediate impact is observed in excessive CPU consumption within the Frontend and Schedule worker components of the Temporal infrastructure. Because the server attempts to evaluate every excluded candidate time sequentially without capping the search depth or iterations, it consumes disproportionate processing resources. This behavior transforms what should be a standard administrative operation into a vector for sustained resource depletion, effectively starving other legitimate workflow executions of necessary compute capacity.
The persistence of this vulnerability exacerbates its severity by enabling long-term impact beyond immediate request-based exploitation. Once a malicious schedule specification is persisted to the database, it triggers continuous failures and retries in its backing Schedule Workflow. This creates a self-sustaining cycle where CPU consumption continues autonomously without requiring additional external requests from an attacker. The system remains degraded until explicit intervention occurs, such as deleting the problematic schedule or manually terminating the associated workflow instance. This characteristic distinguishes the vulnerability from transient attacks that cease when the connection closes, making it particularly dangerous for production environments relying on high availability and consistent performance metrics.
In terms of industry standard classifications, this issue aligns with CWE-400, which covers Uncontrolled Resource Consumption, specifically highlighting scenarios where a system fails to limit resources used during processing operations. Furthermore, from an offensive security perspective as defined by the MITRE ATT&CK framework, this vulnerability facilitates Denial of Service via resource exhaustion techniques. It allows for sustained disruption through automated, persistent mechanisms rather than relying solely on high-volume traffic floods, thereby complicating detection and mitigation efforts that typically focus on network-level anomalies.
Mitigation strategies must address both immediate remediation and long-term architectural resilience. Administrators should immediately audit existing schedules within their namespaces to identify any configurations involving complex exclusion calendars paired with tight cadences. Updating the Temporal Server software to a patched version is critical, as it introduces bounds on work performed during schedule evaluation. Additionally, implementing strict rate limiting or resource quotas for namespace write operations can provide an additional layer of defense against malicious actors attempting to exploit this flaw. Monitoring CPU usage patterns in Frontend and Schedule worker components serves as an effective detection mechanism for identifying ongoing exploitation attempts before they lead to complete service degradation.