Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-02-06 | 1 | General1 |
| 2026-02-07 | 2 | Disclosure1Patch1 |
| 2026-02-17 | 1 | Disclosure1 |
Masked namespace vulnerability in Temporal https://depthfirst.com/post/the-masked-namespace-vulnerability-in-temporal-cve-2025-14986
Post summary
The post announces a new namespace-related vulnerability in Temporal (CVE‑2025‑14986) with no additional details, remediation, or evidence of active exploitation.
Critical vulnerability (CVE-2025-14986) found in Temporal's Go server! This flaw allows unauthorized cross-namespace actions, bypassing security policies. Update your systems to prevent potential breaches. #TemporalSecurity #CVE https://t.co/CSDufS5FPU
Post summary
A critical CVE-2025-14986 in Temporal’s Go server enables unauthorized cross-namespace actions; users are urged to update their systems to mitigate potential breaches.
https://depthfirst.com/post/the-masked-namespace-vulnerability-in-temporal-cve-2025-14986 TemporalのExecuteMultiOperationエンドポイントで「Masked Namespace」脆弱性(CVE-2025-14986)を発見。 この脆弱性は、認証された名前空間とは異なる名前空間でポリシー評価をさせることを可能にしました。 Temporal v1.27で修正済みです。
Post summary
The post reports the discovery of the Masked Namespace vulnerability (CVE-2025-14986) in Temporal's ExecuteMultiOperation endpoint, explains how it enables policy evaluation in an unauthorized namespace, and notes that it was fixed in version 1.27.
Masked namespace vulnerability in Temporal https://depthfirst.com/post/the-masked-namespace-vulnerability-in-temporal-cve-2025-14986 (https://news.ycombinator.com/item?id=46917477)
Post summary
The post references CVE-2025-14986 for a masked namespace vulnerability in Temporal but offers no further exploitation details, patch information, or technical specifics.