CVE-2026-16652 (GCVE-0-2026-16652)
Vulnerability from cvelistv5
Published
2026-09-21 11:23
Modified
2026-09-21 15:33
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-606 - Unchecked Input for Loop Condition
Summary
Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.
References
| URL | Tags | |
|---|---|---|
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Temporal Technologies, Inc. | Temporal Server |
Version: 1.17.0 ≤ 1.29.7 Version: 1.30.0 ≤ Version: 1.31.0 ≤ cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-16652",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-21T15:32:53.335177Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T15:33:15.387Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"cpes": [
"cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"Schedules"
],
"packageName": "go.temporal.io/server",
"product": "Temporal Server",
"programFiles": [
"service/worker/scheduler/spec.go"
],
"programRoutines": [
{
"name": "CompiledSpec.GetNextTime"
}
],
"repo": "https://github.com/temporalio/temporal",
"vendor": "Temporal Technologies, Inc.",
"versions": [
{
"lessThanOrEqual": "1.29.7",
"status": "affected",
"version": "1.17.0",
"versionType": "semver"
},
{
"lessThan": "1.30.7",
"status": "affected",
"version": "1.30.0",
"versionType": "semver"
},
{
"lessThan": "1.31.3",
"status": "affected",
"version": "1.31.0",
"versionType": "semver"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eIn Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound.\u003c/p\u003e"
}
],
"value": "In Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "An external security researcher who reported this issue responsibly to Temporal Technologies"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eTemporal Server did not bound the work performed while searching for a Schedule\u0027s next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.\u003c/p\u003e"
}
],
"value": "Temporal Server did not bound the work performed while searching for a Schedule\u0027s next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Availability degradation or denial of service caused by excessive CPU consumption and a persistent Schedule retry condition. No confidentiality or integrity impact was identified."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-606",
"description": "CWE-606: Unchecked Input for Loop Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-21T11:23:47.298Z",
"orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"shortName": "Temporal"
},
"references": [
{
"name": "Fix pull request",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/pull/11014"
},
{
"name": "Fix commit",
"tags": [
"patch"
],
"url": "https://github.com/temporalio/temporal/commit/c10c730e53ae394fffaefe44ba3722150fe40720"
},
{
"name": "Temporal Server 1.30.7",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
},
{
"name": "Temporal Server 1.31.3",
"tags": [
"release-notes"
],
"url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound.\u003c/p\u003e"
}
],
"value": "Upgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound."
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Temporal Server Schedule exclusion search can cause excessive CPU consumption",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation.\u003c/p\u003e"
}
],
"value": "Until upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
"assignerShortName": "Temporal",
"cveId": "CVE-2026-16652",
"datePublished": "2026-09-21T11:23:47.298Z",
"dateReserved": "2026-07-22T18:08:55.806Z",
"dateUpdated": "2026-09-21T15:33:15.387Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"61241ed8-fa44-4f23-92db-b8c443751968\", \"shortName\": \"Temporal\", \"dateUpdated\": \"2026-09-21T11:23:47.298Z\"}, \"title\": \"Temporal Server Schedule exclusion search can cause excessive CPU consumption\", \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"cweId\": \"CWE-606\", \"description\": \"CWE-606: Unchecked Input for Loop Condition\", \"type\": \"CWE\"}]}], \"impacts\": [{\"descriptions\": [{\"lang\": \"en\", \"value\": \"Availability degradation or denial of service caused by excessive CPU consumption and a persistent Schedule retry condition. No confidentiality or integrity impact was identified.\"}]}], \"affected\": [{\"vendor\": \"Temporal Technologies, Inc.\", \"product\": \"Temporal Server\", \"collectionURL\": \"https://pkg.go.dev\", \"packageName\": \"go.temporal.io/server\", \"repo\": \"https://github.com/temporalio/temporal\", \"modules\": [\"Schedules\"], \"programFiles\": [\"service/worker/scheduler/spec.go\"], \"programRoutines\": [{\"name\": \"CompiledSpec.GetNextTime\"}], \"versions\": [{\"status\": \"affected\", \"version\": \"1.17.0\", \"lessThanOrEqual\": \"1.29.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.30.0\", \"lessThan\": \"1.30.7\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.31.0\", \"lessThan\": \"1.31.3\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\", \"cpes\": [\"cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Temporal Server did not bound the work performed while searching for a Schedule\u0027s next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eTemporal Server did not bound the work performed while searching for a Schedule\u0027s next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.\u003c/p\u003e\"}]}], \"references\": [{\"url\": \"https://github.com/temporalio/temporal/pull/11014\", \"name\": \"Fix pull request\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/temporalio/temporal/commit/c10c730e53ae394fffaefe44ba3722150fe40720\", \"name\": \"Fix commit\", \"tags\": [\"patch\"]}, {\"url\": \"https://github.com/temporalio/temporal/releases/tag/v1.30.7\", \"name\": \"Temporal Server 1.30.7\", \"tags\": [\"release-notes\"]}, {\"url\": \"https://github.com/temporalio/temporal/releases/tag/v1.31.3\", \"name\": \"Temporal Server 1.31.3\", \"tags\": [\"release-notes\"]}], \"metrics\": [{\"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}], \"cvssV4_0\": {\"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"exploitMaturity\": \"NOT_DEFINED\", \"Safety\": \"NOT_DEFINED\", \"Automatable\": \"NOT_DEFINED\", \"Recovery\": \"NOT_DEFINED\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\", \"version\": \"4.0\", \"baseSeverity\": \"HIGH\", \"baseScore\": 7.1, \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N\"}}], \"configurations\": [{\"lang\": \"en\", \"value\": \"In Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eIn Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound.\u003c/p\u003e\"}]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Until upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eUntil upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation.\u003c/p\u003e\"}]}], \"solutions\": [{\"lang\": \"en\", \"value\": \"Upgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound.\", \"supportingMedia\": [{\"type\": \"text/html\", \"base64\": false, \"value\": \"\u003cp\u003eUpgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound.\u003c/p\u003e\"}]}], \"credits\": [{\"lang\": \"en\", \"value\": \"An external security researcher who reported this issue responsibly to Temporal Technologies\", \"type\": \"finder\"}], \"source\": {\"discovery\": \"EXTERNAL\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-16652\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-21T15:32:53.335177Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-21T15:33:08.865Z\"}}]}",
"cveMetadata": "{\"cveId\": \"CVE-2026-16652\", \"assignerOrgId\": \"61241ed8-fa44-4f23-92db-b8c443751968\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"Temporal\", \"dateReserved\": \"2026-07-22T18:08:55.806Z\", \"datePublished\": \"2026-09-21T11:23:47.298Z\", \"dateUpdated\": \"2026-09-21T15:33:15.387Z\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…