CVSS 4.0
1.3 lowCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/S:N/AU:Y/R:U/RE:L/U:GreenCVE-2025-14986
Low (1.3). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in go.temporal.io/server 1.27.4, 1.28.2, 1.29.2.
When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context.
This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 36% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-p2gr-hm8g-q772 | Go | go.temporal.io/server | >=1.24.0 <1.27.4 | 1.27.4 |
| GHSA-p2gr-hm8g-q772 | Go | go.temporal.io/server | >=1.28.0 <1.28.2 | 1.28.2 |
| GHSA-p2gr-hm8g-q772 | Go | go.temporal.io/server | >=1.29.0 <1.29.2 | 1.29.2 |
| GO-2025-4272 | Go | go.temporal.io/server | >=1.24.0 <1.27.4 >=1.28.0 <1.28.2 >=1.29.0 <1.29.2 | 1.27.4, 1.28.2, 1.29.2 |