Temporal Server worker deployment compute provider executes a caller-supplied command on the Worker Service host

temporalio/sqlparser deeply nested unary expressions can cause a fatal stack overflow during AST traversal

temporalio/sqlparser malformed MySQL version comments can cause a panic

Temporal Server completion callback source header can direct attacker-chosen requests to the internal frontend with administrator authorization

Temporal Server Schedule exclusion search can cause excessive CPU consumption

Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces

Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state

Cross Namespace Commands Authorization Bypass

Insecure defaults in open-source Temporal Server before version 1.20 on all platforms allows an attacker to craft a task token with access to a namespace other than the one…

ExecuteMultiOperation Namespace Policy Bypass