temporal up to 1.28.3/1.29.5/1.30.3 StreamWorkflowReplicationMessages endpoint missing authentication

Summaryinfo

A vulnerability, which was classified as critical, was found in temporal up to 1.28.3/1.29.5/1.30.3. The impacted element is an unknown function of the file streaming AdminService/StreamWorkflowReplicationMessages endpoint. The manipulation results in missing authentication. This vulnerability is identified as CVE-2026-5724. The attack can be executed remotely. There is not any exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability was found in temporal up to 1.28.3/1.29.5/1.30.3. It has been classified as critical. Affected is some unknown functionality of the file streaming AdminService/StreamWorkflowReplicationMessages endpoint. The manipulation with an unknown input leads to a missing authentication vulnerability. CWE is classifying the issue as CWE-306. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests without credentials. This endpoint is registered on the same port as WorkflowService and cannot be disabled independently. An attacker with network access to the frontend port could open the replication stream without authentication. Data exfiltration is possible, but  only when a configured replication target is correctly configured and the attacker has knowledge of the cluster configuration, as the history service validates cluster IDs and peer membership before returning replication data. The fix was applied per release line: it is present in 1.28.4, 1.29.6, 1.30.4, 1.31.2, and 1.32.0 and later releases on each line. Releases 1.31.0 and 1.31.1 do not contain the fix and are affected. Temporal Cloud is not affected.

The weakness was released with UiPath. The advisory is available at github.com. This vulnerability is traded as CVE-2026-5724 since 04/06/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit.

Upgrading to version 1.28.4 eliminates this vulnerability. The upgrade is hosted for download at github.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-21607). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• temporal

Version

• 1.28.0
• 1.28.1
• 1.28.2
• 1.28.3
• 1.29.0
• 1.29.1
• 1.29.2
• 1.29.3
• 1.29.4
• 1.29.5
• 1.30.0
• 1.30.1
• 1.30.2
• 1.30.3

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion