CVE-2025-14987: Temporal Server Privilege Escalation Flaw

CVE-2025-14987 Overview

CVE-2025-14987 is a cross-namespace authorization flaw in the Temporal workflow orchestration server. When system.enableCrossNamespaceCommands is enabled (the default configuration), the frontend service authorizes the RespondWorkflowTaskCompleted gRPC call using the outer request namespace. The history service later resolves the command using the namespace embedded in the command attributes without re-authorizing the caller against that target namespace. A worker holding credentials for one namespace can start child workflows, signal external workflows, or cancel workflow executions in a different namespace. The issue affects Temporal releases up through 1.29.1 and is tracked as an authorization vulnerability [CWE-863].

Critical Impact
An authenticated worker can create, signal, or cancel workflows in namespaces it is not authorized to access, breaking multi-tenant isolation.

Affected Products

Temporal Server versions through 1.27.3
Temporal Server versions through 1.28.1
Temporal Server versions through 1.29.1

Discovery Timeline

2025-12-30 - CVE-2025-14987 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14987

Vulnerability Analysis

Temporal separates the frontend gRPC boundary from the history service that executes workflow state transitions. The frontend performs the authorization decision for RespondWorkflowTaskCompleted using the namespace supplied on the outer request. That request carries a list of workflow task commands, and several commands accept a target namespace inside their attributes. Affected command types include StartChildWorkflowExecution, SignalExternalWorkflowExecution, and RequestCancelExternalWorkflowExecution.

The history service later processes each command and resolves the embedded namespace to route the operation. This resolution step does not re-check whether the caller is authorized for the embedded target namespace. The result is a broken access control condition that lets a worker cross tenant boundaries within a shared Temporal cluster.

Root Cause

The root cause is an authorization decision made at the wrong architectural layer. The frontend authorizes the outer request namespace, but the effective target namespace is determined later by attributes the caller controls. Because no downstream authorization check re-validates the caller against the attribute-supplied namespace, the trust boundary is bypassed. This pattern maps to [CWE-863: Incorrect Authorization].

Attack Vector

An attacker requires valid worker credentials for at least one namespace on the target Temporal cluster. From that authenticated position, the worker completes a workflow task and includes a command whose attributes reference a foreign namespace. The frontend permits the call, and the history service acts on it, producing effects in the victim namespace. No user interaction is required, and the attack occurs over the network via standard Temporal gRPC APIs.

See the upstream release notes for technical details in Temporal v1.29.2 release, Temporal v1.28.2 release, and Temporal v1.27.4 release.

Detection Methods for CVE-2025-14987

Indicators of Compromise

Workflow history events showing StartChildWorkflowExecution, SignalExternalWorkflowExecution, or RequestCancelExternalWorkflowExecution where the target namespace differs from the parent workflow's namespace.
Audit log entries where the authenticated principal's namespace claim does not match the namespace of resulting workflow state changes.
Unexpected child workflow, signal, or cancel activity appearing in tenant namespaces without a corresponding parent workflow in that namespace.

Detection Strategies

Query the visibility store for cross-namespace parent/child relationships and reconcile them against expected inter-namespace workflow patterns.
Correlate frontend gRPC access logs with history service execution events to flag mismatches between the authorized namespace and the executed namespace.
Alert on any usage of external workflow commands whose attribute namespace was not previously observed for the calling worker identity.

Monitoring Recommendations

Enable structured audit logging on the Temporal frontend and forward logs to a centralized analytics platform for cross-namespace correlation.
Track the system.enableCrossNamespaceCommands configuration state across all cluster nodes and alert on drift from the intended value.
Baseline normal inter-namespace workflow behavior per tenant and alert on deviations in volume or destination namespace.

How to Mitigate CVE-2025-14987

Immediate Actions Required

Upgrade Temporal Server to 1.27.4, 1.28.2, or 1.29.2 depending on your release train.
If upgrading immediately is not possible, set system.enableCrossNamespaceCommands to false to disable the vulnerable code path.
Review workflow history in shared clusters for evidence of unauthorized cross-namespace commands during the exposure window.

Patch Information

Temporal fixed the issue in versions 1.27.4, 1.28.2, and 1.29.2. Patched releases enforce authorization for the target namespace embedded in workflow command attributes in addition to the outer request namespace. Release artifacts are available at Temporal v1.27.4, Temporal v1.28.2, and Temporal v1.29.2.

Workarounds

Disable cross-namespace commands by setting system.enableCrossNamespaceCommands to false in the dynamic configuration until the cluster is patched.
Segregate high-sensitivity tenants onto dedicated Temporal clusters so a single-namespace compromise cannot reach other tenants.
Restrict issuance of worker credentials and enforce least privilege on namespace access at your identity provider.

bash

# Configuration example: disable cross-namespace commands in Temporal dynamic config
# dynamicconfig/config.yaml
system.enableCrossNamespaceCommands:
  - value: false
    constraints: {}