Homepage

CVE-2026-5724 Affecting temporal package, versions <1.6.2-r4

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.04% (12th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-TEMPORAL-16078807
  • published16 Apr 2026
  • disclosed10 Apr 2026
Report a new vulnerability Found a mistake?

Introduced: 10 Apr 2026

CVE-2026-5724  (opens in a new tab)

How to fix?

Upgrade Minimos:latest temporal to version 1.6.2-r4 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream temporal package and not the temporal package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests without credentials. This endpoint is registered on the same port as WorkflowService and cannot be disabled independently. An attacker with network access to the frontend port could open the replication stream without authentication. Data exfiltration is possible, but  only when a configured replication target is correctly configured and the attacker has knowledge of the cluster configuration, as the history service validates cluster IDs and peer membership before returning replication data.

Temporal Cloud is not affected.