Listen to this Post
The vulnerability occurs in Temporal server when the configuration setting `frontend.enableExecuteMultiOperation` is enabled. This feature allows clients to execute multiple operations within a single request, specifically including an embedded StartWorkflowExecutionRequest. Normally, the server authorizes and applies namespace-specific validation and feature gates based on the namespace specified in the outer ExecuteMultiOperationRequest. However, due to a flaw in versions 1.24.0 through 1.29.1, the server incorrectly uses the `Namespace` field from the embedded `StartWorkflowExecutionRequest` for validation and feature gate checks, instead of the outer request’s namespace. An attacker authorized for one namespace can craft a request where the embedded start request specifies a different namespace. While the workflow execution is still correctly created in the authorized outer namespace, all policy checks, rate limits, and feature gates are applied using the context of the unauthorized, embedded namespace. This allows the caller to bypass intended restrictions like rate limits, access controls, or specific workflow policies enforced for their actual namespace. The issue is limited to scenarios where the multi-operation feature is actively enabled. The bypass does not alter where workflows are executed or stored, but misapplies validation logic. Fixed versions correctly propagate the outer namespace context for all validation steps.
Platform: Temporal
Version: 1.24.0-1.29.1
Vulnerability: Namespace policy bypass
Severity: Low
date: December 30, 2025
Prediction: Patched December 31, 2025
What Undercode Say:
Analytics
temporal version
grep enableExecuteMultiOperation config.yaml
curl -X POST http://temporal:7233/api/v1/execute-multi-operation -H "Namespace: authorized-ns" -d '{"requests":[{"startWorkflowExecution":{"namespace":"bypass-ns"}}]}'
how Exploit:
Craft ExecuteMultiOperationRequest with embedded start request namespace set to unauthorized namespace for validation bypass.
Protection from this CVE:
Update to patched versions (1.27.4, 1.28.2, 1.29.2). Disable enableExecuteMultiOperation if unused.
Impact:
Bypass namespace policies and limits.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
