Listen to this Post
This vulnerability exists due to flawed authorization logic when the Temporal server configuration has `system.enableCrossNamespaceCommands` enabled (default state). The frontend service (frontend) authorizes a `RespondWorkflowTaskCompleted` gRPC request based on the namespace declared in the outer request metadata. However, the history service processes the enclosed workflow task commands—such as StartChildWorkflowExecution, SignalExternalWorkflowExecution, and RequestCancelExternalWorkflowExecution—by directly using the target namespace specified within the command’s own attributes, without performing a secondary authorization check. This creates an authorization bypass where a worker, authenticated only for Namespace A, can submit a task for a workflow in Namespace A that contains commands targeting Namespace B. The history service will then execute those commands against Namespace B, allowing unauthorized creation, signaling, or cancellation of workflows across namespace boundaries.
Platform: Temporal Server
Version: < 1.27.4
Vulnerability: Cross-Namespace Authorization Bypass
Severity: Moderate
Date: 2025-12-30
Prediction: 2026-01-09
What Undercode Say:
curl -s https://advisories.temporal.io/feed.xml | grep -A5 -B5 "CROSS-NAMESPACE"
// Example of a malicious command attribute
cmd := &commandpb.StartChildWorkflowExecutionCommandAttributes{
Namespace: "unauthorized-namespace",
WorkflowId: "target-workflow",
// ... other fields
}
How Exploit:
1. Attacker compromises a worker for Namespace A.
- Worker processes a workflow task for Namespace A.
- Worker crafts a response containing commands targeting Namespace B.
4. Server frontend authorizes based on Namespace A.
- History service executes commands in Namespace B without re-authorization.
Protection from this CVE:
1. Update to patched versions.
2. Disable `system.enableCrossNamespaceCommands`.
3. Implement namespace-aware authorization middleware.
4. Audit cross-namespace command logs.
Impact: Unauthorized workflow manipulation across namespaces.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
