Detections
Analytics

Echo: go.temporal.io/server: security update to 1.29.5

low Tenable Cloud Security Plugin ID 457208

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - A writer role user in an attacker-controlled namespace could signal, delete, and reset workflows or
 activities in a victim namespace on the same cluster. Exploitation requires the attacker to know or guess
 specific victim workflow ID(s) and, for signal operations, signal names. This was due to a bug introduced
 in Temporal Server v1.29.0 which inadvertently allowed an attacker to control the namespace name value
 instead of using the server's own trusted name value within the batch activity code. The batch activity
 validated the namespace ID but did not cross-check the namespace name against the worker's bound
 namespace, allowing the per-namespace worker's privileged credentials to operate on an arbitrary
 namespace. Exploitation requires a server configuration where internal components have cross-namespace
 authorization, such as deployment of the internal-frontend service or equivalent TLS-based authorization
 for internal identities. This vulnerability also impacted Temporal Cloud when the attacker and victim
 namespaces were on the same cell, with the same preconditions as self-hosted clusters. (CVE-2026-5199)

Solution

Update the go.temporal.io/server library and its related packages to version 1.29.5 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-5199

Plugin Details

Severity: Low

ID: 457208

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/5/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

Percentile: 96.72

CVSS v2

Risk Factor: Medium

Base Score: 4.9

Temporal Score: 3.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:P/I:P/A:N

CVSS Score Source: CVE-2026-5199

CVSS v3

Risk Factor: High

Base Score: 7.1

Temporal Score: 6.2

Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Low

Base Score: 2.3

Threat Score: 0.6

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:L/SA:L

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/29/2026

Vulnerability Publication Date: 4/1/2026

Reference Information

CVE: CVE-2026-5199