CVE-2026-5724: Go.temporal.io/server Remote Code Execution Vulnerability
MODERATECVE-2026-5724 is a MODERATE remote code execution vulnerability (CWE-306: Missing Authentication for Critical Function) affecting Go.temporal.io/server libraries in the Go ecosystem. The issue involves temporal does not enforce authentication and authorization for the streaming adminservice/streamworkflowreplicationmessages endpoint. Remediation is available by upgrading affected packages to version 1.28.4, 1.29.6, 1.30.4.
CVE-2026-5724 at a Glance
How to Fix CVE-2026-5724
To remediate this vulnerability, upgrade all affected Go.temporal.io/server dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade go.temporal.io/server to 1.28.4Upgrade go.temporal.io/server to 1.29.6Upgrade go.temporal.io/server to 1.30.4Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for go.temporal.io/serverHow to Check if You Are Affected
To determine whether your application is affected by CVE-2026-5724, inspect your project dependencies for Go.temporal.io/server:
inspect dependencies for go.temporal.io/serverAnalyze the terminal output to locate any version of Go.temporal.io/server in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.28.4), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-306: Missing Authentication for Critical Function, where the product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. In Go.temporal.io/server, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2026-5724 Affected Go.temporal.io/server Versions
3 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
go.temporal.io/server
|
Go |
< 1.28.4
|
1.28.4
|
|
go.temporal.io/server
|
Go |
≥ 1.29.0-135.0
< 1.29.6
|
1.29.6
|
|
go.temporal.io/server
|
Go |
≥ 1.30.0-143.0
< 1.30.4
|
1.30.4
|
References
Frequently Asked Questions
What is CVE-2026-5724?
Which Go.temporal.io/server versions are affected?
What version fixes CVE-2026-5724?
Is go.temporal.io/server affected?
What CWE is associated with CVE-2026-5724?
How can I check Go dependencies for CVE-2026-5724?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-q98v-9f9w-f49q",
"modified" : "2026-04-13T19:23:25Z",
"published" : "2026-04-10T21:31:16Z",
"aliases" : [ "CVE-2026-5724" ],
"summary" : "Temporal does not enforce authentication and authorization for the streaming AdminService/StreamWorkflowReplicationMessages endpoint",
"details" : "The frontend gRPC server's streaming interceptor chain did not include the authorization interceptor. When a ClaimMapper and Authorizer are configured, unary RPCs enforce authentication and authorization, but the streaming AdminService/StreamWorkflowReplicationMessages endpoint accepted requests without credentials. This endpoint is registered on the same port as WorkflowService and cannot be disabled independently. An attacker with network access to the frontend port could open the replication stream without authentication. Data exfiltration is possible, but only when a configured replication target is correctly configured and the attacker has knowledge of the cluster configuration, as the history service validates cluster IDs and peer membership before returning replication data.\n\n\n\n\nTemporal Cloud is not affected.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "go.temporal.io/server"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.28.4"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "go.temporal.io/server"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.29.0-135.0"
}, {
"fixed" : "1.29.6"
} ]
} ]
}, {
"package" : {
"ecosystem" : "Go",
"name" : "go.temporal.io/server"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "1.30.0-143.0"
}, {
"fixed" : "1.30.4"
} ]
} ]
} ],
"references" : [ {
"type" : "ADVISORY",
"url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-5724"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/temporalio/temporal"
}, {
"type" : "WEB",
"url" : "https://github.com/temporalio/temporal/releases/tag/v1.28.4"
}, {
"type" : "WEB",
"url" : "https://github.com/temporalio/temporal/releases/tag/v1.29.6"
}, {
"type" : "WEB",
"url" : "https://github.com/temporalio/temporal/releases/tag/v1.30.4"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-306" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2026-04-13T19:23:25Z",
"nvd_published_at" : "2026-04-10T21:16:28Z"
}
}