Temporal Server Kubernetes compute provider runs caller-chosen commands
The workflow management server can be hacked.
Summary
The Kubernetes worker provider (k8s) in Temporal Server builds its client from caller-supplied configuration and can run a command of the caller's choosing on the Worker Service host. An authenticated user with only read access to one namespace can reach it, and exposure depends on the compute provider allowlist.
Affected when
- Temporal Server 1.31.0 through 1.31.2 with the allowlist unset, or k8s added to the allowlist
- Authorizer and claim mapper configured
- Authenticated caller with read access to a single namespace
What to do
Update 1.31 releases to 1.31.5 and 1.32 releases to 1.32.2 or later. Before updating, check that workercontroller.compute_providers.enabled does not contain k8s, and on 1.31.0 through 1.31.2 that it is not unset.
Update to at least the version for your product:
- Temporal Server 1.31 1.31.5 or later
- Temporal Server 1.32 1.32.2 or later
Products and platforms
CVE IDs
Sources
- Advisory: github.com (opens in a new tab) · github.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen