CVE-2025-14987
Cross Namespace Commands Authorization Bypass
Reported by temporal · Published December 30, 2025
go.temporal.io/server is fixed in 1.29.2, 1.29.0-135.0.0.20251218190115-b292a32bacdf, 1.29.0-135.0.0.20251218190115 and 2 more (Go Modules)
When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace. This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| go.temporal.io/server | Go Modules | 1.29.2, 1.29.0-135.0.0.20251218190115-b292a32bacdf, 1.29.0-135.0.0.20251218190115, 1.28.2, 1.27.4 |
| temporal | GitHub Packages | 1.29.1, 1.28.1, 1.27.3 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Temporal | Temporal | 0, 0, 0 |
| go.temporal.io | server | 0, 1.28.0, 1.29.0 |
| Temporal | Temporal | 0, 0, 0 |
Timeline
- Dec 30, 2025 CVE Published
- Dec 31, 2025 EPSS Score (30 in total, the first dated here)
- Jan 2, 2026 CVE Updated
- Jan 24, 2026 PoC Published
- Mar 17, 2026 Security Advisory
- Jun 22, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-14987
vulnetix vdb fixes CVE-2025-14987Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-14987/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart