VULNERABILIDADDetectada 09 NOV · 17:56

CVE-2026-87857 Token de paginación del historial de workflows de Temporal Server no vinculado al namespace y workflow…

Temporal Server no vincula un token de paginación del historial de workflows al namespace y workflow indicados en la solicitud que lo presenta. GetWorkflowExecutionHistory y GetWorkflowExecutionHistoryReverse autorizan al llamante contra el namespace de la solicitud y luego seleccionan el historial de la rama registrada dentro del next_page_token provisto por el llamante. Un llamante autenticado con permiso de lectura en un namespace, junto con una continuación genuina no final emitida antes para un workflow de…

5.3MEDIA

CVSS 4.0

Probabilidad de explotaciónSin dato
Explotada activamenteNo confirmada
Exploit públicoNo conocido

Afectados

Temporal Technologies, Inc. Temporal Server
desde 1.0.0 hasta 1.29.7desde 1.30.0 hasta antes de 1.30.7desde 1.31.0 hasta antes de 1.31.3

Qué hacer

Verificá si usás Temporal Server y en qué versión.
Actualizá a la versión corregida que indique el fabricante en su aviso o aplicá su mitigación.
Revisá registros y accesos de los sistemas expuestos para descartar un uso previo.

Calculadora CVSS

CVSS 4.0 · 5.3 MEDIA

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Vector de ataqueRed
Complejidad del ataqueBaja
Requisitos del ataqueNinguno
Privilegios requeridosBajos
Interacción del usuarioNinguna
Confidencialidad (sistema vulnerable)Baja
Integridad (sistema vulnerable)Ninguna
Disponibilidad (sistema vulnerable)Ninguna
Confidencialidad (sistemas posteriores)Ninguna
Integridad (sistemas posteriores)Ninguna
Disponibilidad (sistemas posteriores)Ninguna

Descripción original

Temporal Server does not bind a workflow-history pagination token to the namespace and workflow named in the request that presents it. GetWorkflowExecutionHistory and GetWorkflowExecutionHistoryReverse authorize the caller against the namespace in the request, then select history from the branch recorded inside the caller-supplied next_page_token. The normal history continuation carries a run identifier, event bounds, a persistence cursor, and a branch token, but no namespace or workflow identity, and it is serialized as unauthenticated protobuf bytes. An authenticated caller holding read permission on one namespace, together with a genuine non-final continuation issued earlier for a workflow in a second namespace, can submit that continuation with a request naming the first namespace and receive the second namespace's workflow history, provided the supplied workflow identifier selects the same History shard as the continuation's branch. No workflow with the supplied identifier needs to exist. Because the token is unauthenticated, a holder can also advance its event range and clear its persistence cursor, which returns history events created after that caller's current credential no longer granted access to the continuation's namespace. Determining exposure is a version question rather than a configuration question: every release listed as affected omits the binding check on the forward history path, and on the reverse history path in releases from 1.16.0, which introduced GetWorkflowExecutionHistoryReverse; no setting in an affected release restores it, and affected releases emit no metric or log for the condition, so their telemetry provides no detection. Fixed releases add the check and, when a page token's branch token is not the requested execution's current branch token, record the counter pagination_token_branch_mismatch tagged with namespace and reason and write a History-service warning log reading "Pagination branch token is not the execution's current branch token" with the fields wf-namespace, wf-id, wf-run-id, reason, wf-branch-token, and wf-request-branch-token. Search History warning logs for that message, or for reason=foreign_branch, which denotes a branch token the requested execution never recorded and is not expected in normal operation; reason=non_current_branch denotes a retained but superseded branch of the same execution and can occur legitimately after conflict resolution or failover. A foreign_branch record does not by itself prove the read was refused, because the counter and log are emitted before the enforcement decision and therefore appear both when the check rejects the request and when history.enablePaginationTokenBranchValidationShadowMode is enabled and the read is served; confirm refusal from the gRPC response, which is InvalidArgument carrying a CurrentBranchChangedFailure detail. The metric and log are tagged with the requesting namespace, not the namespace whose history the token selects, so a foreign_branch alert does not name the exposed namespace. The issue does not provide unauthenticated access, construction of a usable continuation from public workflow identifiers, enumeration of workflows for which the caller holds no continuation, or any modification of workflow state.

Referencias (12)

Resumen traducido automáticamente de la descripción original. Fuente: Nureq Monitor. Cómo funciona.