CVE-2026-89139: Temporal Server RCE Vulnerability

CVE-2026-89139 Overview

CVE-2026-89139 is a command injection vulnerability [CWE-78] in Temporal Server. The Worker Service embeds a Worker Controller Instance module that registers a subprocess compute provider. This provider launches worker processes by executing commands specified in the caller's request rather than in operator configuration. An authenticated caller with only a write role in a single namespace can supply an arbitrary program name and argument vector. The Worker Service then executes that command on its host under the server process account.

Critical Impact

A namespace-scoped write role escalates to arbitrary command execution on the Worker Service host, exposing persistence credentials and cluster TLS material for every namespace in the cluster.

Affected Products

• Temporal Server 1.31.0 through 1.31.2
• Official temporal-server binaries for affected releases
• Official Temporal container images for affected releases

Discovery Timeline

• 2026-09-21 - CVE-2026-89139 published to the National Vulnerability Database
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-89139

Vulnerability Analysis

The Worker Controller Instance module registers a compute provider named subprocess. This provider is compiled into the Worker Service and present in stock deployments. The configuration handler invokes every registered provider using the invoke strategy immediately after validating the submitted specification. No scaling decision, task arrival, or unusual request sequence is required to trigger execution.

The caller supplies the program name and full argument vector inside the compute provider configuration of a worker deployment version. The Worker Service then executes that command directly on its own host. Execution runs under the account owning the server process. Because the Worker Service holds persistence credentials for every namespace and the cluster's TLS material, impact reaches beyond the caller's namespace to the entire cluster.

Root Cause

The compute provider allowlist, controlled by the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled, does not deny by default. Its default value is an unset list, and the allowlist check is skipped entirely when the value is unset. Every registered provider is therefore permitted, including subprocess. The separate setting workercontroller.enabled does not gate this path, so deployments that never enabled the worker controller feature are still affected.

Attack Vector

An attacker authenticates to a Temporal cluster with a write role in any single namespace. The attacker submits a worker deployment version configuration that specifies subprocess as the compute provider type and supplies a chosen command and arguments. Upon validation, the Worker Service invokes the provider synchronously and executes the command on its host. Deployments running without an authorizer are outside the scope of this vulnerability because they already grant unrestricted namespace access.

See the Temporal fix pull request #12021 and the auto-scaled workers pull request #129 for technical details of the patched code paths.

Detection Methods for CVE-2026-89139

Indicators of Compromise

• Worker deployment versions whose scaling groups list a compute provider type of subprocess, discoverable by calling DescribeWorkerDeploymentVersion across every worker deployment version in every namespace.
• Unexpected child processes of the temporal-server Worker Service process, particularly shells, interpreters, or network utilities.
• Outbound network connections from the Worker Service host to hosts not associated with normal Temporal cluster traffic.
• Access or exfiltration events involving persistence credentials or TLS material stored on Worker Service hosts.

Detection Strategies

• Enumerate all worker deployment versions per namespace and alert on any scaling group whose compute provider type equals subprocess.
• Audit Temporal API calls that configure worker deployment versions, correlating caller identity and namespace scope against expected operators.
• Monitor process ancestry on Worker Service hosts and flag any process whose parent is the temporal-server binary and that is not an expected worker command.

Monitoring Recommendations

• Ingest Temporal Server logs and host process telemetry into a centralized data lake and correlate deployment version changes with subsequent process launches.
• Track the effective value of workercontroller.compute_providers.enabled per namespace and alert whenever it is unset or contains subprocess.
• Baseline outbound network activity from Worker Service hosts and alert on new destinations following configuration changes.

How to Mitigate CVE-2026-89139

Immediate Actions Required

• Upgrade Temporal Server to 1.31.3 or 1.32.0 or later, both of which remove the exploitable path.
• Enumerate all namespaces and worker deployment versions using DescribeWorkerDeploymentVersion and remove any configuration that references the subprocess compute provider.
• Rotate persistence credentials and cluster TLS material if any Worker Service host may have been reached by an untrusted caller during the exposure window.
• Review authorization policy so that write roles in any namespace are granted only to trusted principals.

Patch Information

Fixes are available in Temporal Server v1.31.3 and v1.32.0. The patched releases remove the caller-supplied command execution path from the subprocess compute provider.

Workarounds

• Set the per-namespace dynamic configuration workercontroller.compute_providers.enabled to an explicit allowlist that excludes subprocess in every namespace, since an unset value permits every provider.
• Restrict namespace write roles to a minimal set of trusted operators until upgrade is complete.
• If upgrading is not immediate, run the Worker Service under a low-privilege service account with restricted filesystem and network permissions to constrain the blast radius of arbitrary command execution.

# Configuration example: per-namespace dynamic configuration entry
# Explicitly allowlist providers and exclude subprocess in every namespace.
workercontroller.compute_providers.enabled:
  - value: []
    constraints:
      namespace: "<namespace-name>"