CVE-2023-3485
Insecure Default Authorization in Temporal Server
- Published
- Updated
- Reserved
- Assigned by
- Temporal
Description
Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one specified in the request. Creation of this task token must be done outside of the normal Temporal server flow. It requires the namespace UUID and information from the workflow history for the target namespace. Under these conditions, it is possible to interfere with pending tasks in other namespaces, such as marking a task failed or completed. If a task is targeted for completion by the attacker, the targeted namespace must also be using the same data converter configuration as the initial, valid, namespace for the task completion payload to be decoded by workers in the target namespace.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| TemporalCNA (assigner) | 3.1 | Low3.0 | CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:L |
| NVDNVD · Modified | 3.1 | Low3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L |
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.0.
Weakness
Affected products
Temporal Technologies Inc. · Temporal Server
- affected 1.9.1 – < 1.20
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Gogo.temporal.io/serverGHSA-gm2g-2xr9-pxxj (opens in a new tab)
What to do
Solution: * Set frontend.enableTokenNamespaceEnforcement https://github.com/temporalio/temporal/pull/3798 to true * Upgrade to version 1.20 or above, where this is the default
References (1)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-gm2g-2xr9-pxxj (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2023-3485)Record last updated .