Skip to content
Heist/ feed
Back to feed
High

Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

Type: advisorySources: OSV

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving the caller's path, query, and request body. Where an internal frontend is deployed with its HTTP API enabled, that client resolves to the internal frontend, which authorizes every request as a system administrator without requiring authentication information. The result is that the server performs an attacker-chosen state-changing HTTP POST against its own administrative API on the caller's behalf, in namespaces where the caller has no permission. The caller never needs network access to the internal frontend, because the History service makes the request. Confirmed effects include terminating Workflows in other namespaces, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The affected routing logic is present in both the HSM and CHASM callback delivery implementations. This description and the CVSS score in this record d

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-87858
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 01:23 UTC · Revision 1

Source evidence

Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

core-osv · Original source

Published 21 Sept 2026, 11:39 UTC

Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving the caller's path, query, and request body. Where an internal frontend is deployed with its HTTP API enabled, that client resolves to the internal frontend, which authorizes every request as a system administrator without requiring authentication information. The result is that the server performs an attacker-chosen state-changing HTTP POST against its own administrative API on the caller's behalf, in namespaces where the caller has no permission. The caller never needs network access to the internal frontend, because the History service makes the request. Confirmed effects include terminating Workflows in other namespaces, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The affected routing logic is present in both the HSM and CHASM callback delivery implementations. This description and the CVSS score in this record d

osv:CVE-2026-87858
Complete source record
{
  "id": "e70780259355b0eb6ba5a7e25fcb523f3a6d719296d0a253097aba0c5eb118d0",
  "url": "https://osv.dev/vulnerability/CVE-2026-87858",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization",
    "summary": "Temporal Server decided whether a Workflow completion callback was internal by reading a caller-supplied HTTP header. An authenticated caller holding only write permission in a single namespace could attach a completion callback whose URL host matched the configured callback address allowlist, whose URL path was any Temporal HTTP API route, and whose header map contained a non-empty header named source. When the History service delivered that callback, the non-empty source header caused it to re-target the request at the local frontend client and rewrite only the scheme and host, preserving the caller's path, query, and request body. Where an internal frontend is deployed with its HTTP API enabled, that client resolves to the internal frontend, which authorizes every request as a system administrator without requiring authentication information. The result is that the server performs an attacker-chosen state-changing HTTP POST against its own administrative API on the caller's behalf, in namespaces where the caller has no permission. The caller never needs network access to the internal frontend, because the History service makes the request. Confirmed effects include terminating Workflows in other namespaces, registering namespaces, modifying another namespace's configuration, and deleting another namespace and its Workflows. The affected routing logic is present in both the HSM and CHASM callback delivery implementations. This description and the CVSS score in this record d",
    "evidence": "osv:CVE-2026-87858",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-87858",
      "aliases": [
        "CVE-2026-87858"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/temporalio/temporal",
              "type": "GIT",
              "events": [
                {
                  "introduced": "f2a389fbab69f89edfb596d4963c04664db4cf89"
                },
                {
                  "fixed": "6263d75ecb887e4b11e67dab867c8af07260f36b"
                },
                {
                  "introduced": "83881961df2bad7d78d93a2d50778dbc8bd1a2fc"
                },
                {
                  "fixed": "8c78934b67fbac43d2ea7f8ada448c539780584d"
                },
                {
                  "introduced": "be848c89192af6c5f9f01477ab2320b6a40d4b67"
                },
                {
                  "fixed": "d94e34a1ebba5410a2e7d07119a76896909591aa"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "1.30.0"
                      },
                      {
                        "fixed": "1.30.7"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "1.31.0"
                      },
                      {
                        "fixed": "1.31.3"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "introduced": "1.25.0"
                      },
                      {
                        "last_affected": "1.29.7"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "6263d75ecb887e4b11e67dab867c8af07260f36b"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.30.7"
                  },
                  {
                    "range": [
                      {
                        "fixed": "8c78934b67fbac43d2ea7f8ada448c539780584d"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.31.3"
                  },
                  {
                    "range": [
                      {
                        "fixed": "d94e34a1ebba5410a2e7d07119a76896909591aa"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.32.0"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.31.2",
            "v1.30.6",
            "v1.30.5",
            "v1.30.4.1",
            "v1.31.1",
            "v1.31.0",
            "v1.30.4",
            "v1.30.3",
            "v1.30.2",
            "v1.30.1",
            "v1.30.0"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-87858.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:52.615998474Z",
      "provider": "osv",
      "references": [
        "https://pkg.go.dev",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87858.json",
        "https://github.com/temporalio/temporal/releases/tag/v1.30.7",
        "https://github.com/temporalio/temporal/releases/tag/v1.31.3",
        "https://github.com/temporalio/temporal/releases/tag/v1.32.0",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-87858",
        "https://github.com/temporalio/temporal/pull/11965",
        "https://github.com/temporalio/temporal/pull/11982",
        "https://github.com/temporalio/temporal/pull/12085",
        "https://github.com/temporalio/temporal"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-807"
        ],
        "cna_assigner": "Temporal",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/87xxx/CVE-2026-87858.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-87858",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 521310,
  "published_at": "2026-09-21T11:39:52.412+00:00"
}