Temporal Technologies Inc. | Trust Center

CVE-2026-65655 is a Low-severity issue affecting Temporal UI Server versions 2.7.0 through 2.53.1, where OAuth authentication cookies may be issued without the Secure attribute when TLS terminates at a reverse proxy that connects to UI Server over HTTP. Customers using this configuration should upgrade to Temporal UI Server v2.53.2 or later.

CVE published in Temporal Server from versions 1.24.0 before 1.28.4, 1.29.0 before 1.29.6, 1.30.0 before 1.30.4, and 1.31.0 before 1.31.2. We recommend upgrading Temporal Server to the most updated unaffected version.

Summary: CVE-2026-519

Recommended Action for OSS Users: Upgrade to v1.29.5 or v1.30.3. Version 1.28 is not affected.

CVEs published for Temporal OSS server: CVE-2025-14987 and CVE-2025-14986

We recommend upgrading Temporal Server to 1.27.4, 1.28.2, or 1.29.2.

CVE published in Temporal OSS server default authorizer.

We recommend upgrading Temporal Server to 1.26.3, 1.27.3, 1.28.1 or later.

We’re aware of the Salesloft Drift security incident affecting some Salesforce customers. We do not use Drift; our systems and customer data were not impacted by this incident.

CVE published in Temporal api-go library from versions 0 to before 1.44.1. We recommend customers using both the proxy package and a gRPC proxy upgrade the Temporal api-go library to the most updated unaffected version.

We are aware of the outage involving Microsoft systems and Crowdstrike. We have determined that neither Temporal Cloud nor our internal systems are impacted by this event. You can check the status of Temporal Cloud at https://status.temporal.io/.

CVE published in Temporal Server from versions 0 before 1.20.5, 1.21.0 before 1.21.6, and 1.22.0 before 2.22.7. We recommend customers upgrade to Temporal Server to the most updated unaffected version.

CVE published in UI server from versions 2.16.2 before 2.25.0. We recommend customers upgrade to ui-server v2.25.0+.

We are aware of the recently disclosed vulnerability CVE-2024-3094, which involves manipulation of the xz utility from at least version 5.6.0.
Following internal investigation, we have determined that Temporal Cloud and the Temporal OSS server image are not impacted by this vulnerability.

2023-07-03: CVE-2023-3485 published. We recommend customers upgrade to 1.20 or later. If unable, the dynamic configuration option frontend.enableTokenNamespaceEnforcement should be set to true.