Skip to content
CVE Tracker
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API documentationPage
  • MCP serverPage
  • Data sourcesPage
  • ChangelogPage
  • AboutPage
  • How it's builtPage
Back

CVE-2026-104355

Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces

High7.0EPSS 0.36%
Published
Updated
Reserved
Assigned by
Temporal

Description

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote clusters an administrator has registered with connection enabled; the sending side excludes local namespaces, but the receiving side does not apply the same rule. When an inbound task names an existing namespace, the server checks at most that the namespace identifiers match, then overwrites its state, description, owner, retention, archival settings, and cluster list, and its active cluster when the task carries a higher failover version, without checking that the namespace is global. A party that controls a registered peer's replies, by operating or compromising it, can therefore change any local namespace whose name and identifier it can supply, without any credential on the receiving cluster: for example, marking it Deprecated, making the peer its active cluster, and shortening its retention, after which new Workflow starts in that namespace fail. Local namespaces include the built-in temporal-system namespace. Namespace metadata the History service refreshes from the peer while processing its history replication tasks passes through the same logic. A cluster with no remote cluster registered with connection enabled is not exposed.

Scores

CVSS scores of CVE-2026-104355, by who scored it
Scored byCVSSScoreVector
TemporalCNA (assigner)4.0High7.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
NVDNVD · Awaiting Analysis4.0High7.0CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.36% · top 70% of all CVEs (6 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: partial
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.0.

Weakness

Affected products

What to do

Solution: Upgrade to Temporal Server 1.30.8, 1.31.4, or 1.32.1, as appropriate for the deployed minor release line, and keep the dynamic configuration setting history.validateReplicationTaskSourceCluster at its default of true. Fixed releases ignore an inbound namespace replication task, including one applied through the namespace metadata refresh that history replication can trigger, when it targets a namespace the receiving cluster stores as local, and ignore inbound task queue user data replication for a local namespace. With history.validateReplicationTaskSourceCluster enabled, fixed releases also ignore an inbound history replication task when the sending cluster is not in the namespace's cluster list, which for a local namespace is every remote cluster. The fix does not change how a connected peer can update a global namespace replicated with the receiving cluster. Fixed releases do not repair a local namespace that was already modified; review local namespaces, including temporal-system, as described in the workarounds. Temporal Server releases up to and including 1.29.7 are outside the supported window and receive no fix; operators on those releases should upgrade to a supported line.

Workaround: Until upgrading, register a remote cluster, and keep its connection enabled, only when that cluster and everyone able to control it are trusted with administrative authority over every namespace on the receiving cluster, including its local namespaces and temporal-system. Disabling the connection to a remote cluster stops the receiving cluster from pulling replication tasks from it, and also stops legitimate replication of global namespaces with that cluster. Review local namespaces, including temporal-system, for a cluster list or active cluster other than the current cluster.

References (9)

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-104355 badge
[![CVE-2026-104355](https://trackcve.app/badge/CVE-2026-104355.svg)](https://trackcve.app/cve/CVE-2026-104355)

Record last updated .