High severity · published Sep 21, 2026
CVE-2026-16652
Temporal Server Schedule exclusion search can cause excessive CPU consumption
7.1
CVSS
0.5%
EPSS
No
On KEV
Description
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 40% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TS
Temporal Server · Temporal Technologies, Inc.
1.17.0 through 1.29.7; 1.30.0 before 1.30.7; 1.31.0 before 1.31.3 · source: vendor
Affected product
TS
Temporal Server
Temporal Technologies, Inc.
More from Temporal Server
8.7
CVE-2026-89139
Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host
8.7
CVE-2026-65651
temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal
8.7
CVE-2026-16651
temporalio/sqlparser malformed MySQL version comments can cause a panic
7.2
CVE-2026-87858
Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization
7.0
CVE-2026-104355
Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces