CVE-2026-5724: Missing Authentication on Streaming gRPC Replication Endpoint
The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests without credentials. This endpoint is registered on the same port as WorkflowService and cannot be disabled independently. An attacker with network access to the frontend port could open the replication stream without authentication. Data exfiltration is possible, but only when a configured replication target is correctly configured and the attacker has knowledge of the cluster configuration, as the history service validates cluster IDs and peer membership before returning replication data.
Temporal Cloud is not affected.
Other sources
The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests without credentials. This endpoint is registered on the same port as WorkflowService and cannot be disabled independently. An attacker with network access to the frontend port could open the replication stream without authentication. Data exfiltration is possible, but only when a configured replication target is correctly configured and the attacker has knowledge of the cluster configuration, as the history service validates cluster IDs and peer membership before returning replication data.
The fix was applied per release line: it is present in 1.28.4, 1.29.6, 1.30.4, 1.31.2, and 1.32.0 and later releases on each line. Releases 1.31.0 and 1.31.1 do not contain the fix and are affected.
Temporal Cloud is not affected.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/go.temporal.io/serverto a version that resolves this vulnerability.Fixed in 1.30.4 - Upgrade
Upgrade
go/go.temporal.io/serverto a version that resolves this vulnerability.Fixed in 1.29.6 - Upgrade
Upgrade
go/go.temporal.io/serverto a version that resolves this vulnerability.Fixed in 1.28.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.2 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.32.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.30.4 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.29.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.28.4 - Configuration
Update the frontend gRPC server streaming interceptor chain so the authorization interceptor is included for the streaming AdminService/StreamWorkflowReplicationMessages replication endpoint; the fix was that the streaming interceptor chain did not include the authorization interceptor.
Frontend gRPC server (streaming interceptor chain) authorization interceptor inclusion for streaming AdminService/StreamWorkflowReplicationMessages endpoint = include authorization interceptor
Event History
Frequently Asked Questions
What is the severity of CVE-2026-5724?
CVE-2026-5724 has been rated as a medium severity vulnerability due to missing authentication on the streaming gRPC replication endpoint.
How do I fix CVE-2026-5724?
To fix CVE-2026-5724, you need to update the Temporal Server to version 1.30.4 or later, or to version 1.29.6, or to version 1.28.4.
What types of attacks does CVE-2026-5724 enable?
CVE-2026-5724 could allow unauthorized users to gain access to streaming data and perform actions without proper authentication.
Which versions of Temporal Server are affected by CVE-2026-5724?
CVE-2026-5724 affects versions of Temporal Server prior to 1.30.4, 1.29.6, and 1.28.4 depending on the installed version.
Is CVE-2026-5724 related to streaming RPCs in Temporal Server?
Yes, CVE-2026-5724 specifically relates to the missing authentication in the streaming gRPC replication endpoint of the Temporal Server.