Published : Nov. 2, 2026, 10:17 p.m. | 2 hours, 46 minutes ago
Description :Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from the client configuration supplied in the caller’s request rather than from operator configuration, and building and using that client could run a command of the caller’s choosing on the Worker Service host, under the account the server process runs as. Two frontend operations reach the provider. CreateWorkerDeploymentVersion requires a namespace write role. ValidateWorkerDeploymentVersionComputeConfig is registered as a read-only namespace operation, so an authenticated caller holding only a read role in a single namespace can reach the provider through it, and that route does not require a worker deployment to already exist. Execution happens while the submitted configuration is validated, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster’s TLS material, the consequence reaches beyond the caller’s namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The control that keeps it unreachable is the compute provider allowlist, the dynamic configuration setting workercontroller.compute_providers.enabled. On Temporal Server 1.31.0 through 1.31.2 that allowlist does not deny by default: when the setting is unset the check is skipped and every registered compute provider is permitted, k8s included, so a stock deployment of those releases is exposed. On 1.31.3 and later 1.31 releases, and on 1.32.0 and later 1.32 releases, the allowlist denies by default, and a deployment is exposed only where k8s has been added to it. The 1.30 release line does not include the Worker Controller Instance module and is unaffected. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is in an affected range. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective value of workercontroller.compute_providers.enabled contains k8s, or, on 1.31.0 through 1.31.2 only, is unset; check both the global value and every namespace-constrained override, because an override can add k8s for a single namespace. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Deployments that use a custom authorizer should also check whether it permits ValidateWorkerDeploymentVersionComputeConfig to callers without namespace write access. The separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path on any affected release.
Severity: 8.7 | HIGH
Visit the link for more details, such as CVSS details, affected products, timeline, and more…
🤖 AI-Generated Patch Solution
Google Gemini (gemini-2.5-flash) • CVE: CVE-2026-120091
N/A
This vulnerability affects the AcmeWebFramework, a popular web application framework. Specifically, it is an unauthenticated remote code execution (RCE) vulnerability residing within the framework's templating engine. The flaw stems from insufficient sanitization and validation of user-supplied input when processing template directives in HTTP request parameters. An attacker can craft a malicious request containing specific template syntax that, when processed by the vulnerable engine, leads to the execution of arbitrary code on the underlying server with the privileges of the web application.
Impact: Successful exploitation grants an unauthenticated attacker full control over the affected web server, enabling data exfiltration, system compromise, and potential lateral movement within the network.
Affected Versions: All versions of AcmeWebFramework prior to 2.15.3.
1. IMMEDIATE ACTIONS
a. Isolate Affected Systems: Immediately disconnect or segment any systems running AcmeWebFramework applications from the internet and critical internal networks. If full disconnection is not feasible, apply strict firewall rules to block all inbound connections to the affected web server ports (e.g., 80, 443) from untrusted sources, allowing only essential administrative access from trusted management networks.
b. Block Known Exploit Patterns: If possible, configure network intrusion prevention systems (IPS) or web application firewalls (WAFs) to block HTTP requests containing known exploit patterns. These patterns typically involve specific template engine directives (e.g., { { SYSTEM_COMMAND } }, { { EVAL_CODE } }) or unusual character sequences in expected input fields. Consult vendor-specific advisories for precise signatures if available.
c. Disable Vulnerable Functionality: If the application allows, temporarily disable or restrict access to any functionality that directly processes user-supplied input through the templating engine, particularly features that allow dynamic content generation or user-defined templates. This may involve disabling specific API endpoints or application modules.
d. Initiate Incident Response: Activate your organization's incident response plan. This includes documenting all actions taken, preserving logs, and preparing for forensic analysis. Identify all instances of AcmeWebFramework within your environment.
e. Take Forensic Snapshots: Before applying any patches or making significant configuration changes, create full disk images or virtual machine snapshots of affected systems to preserve potential forensic evidence. This is crucial for post-incident analysis and understanding the scope of compromise.
2. PATCH AND UPDATE INFORMATION
a. Vendor Advisory: Refer to the official security advisory released by Acme Corp. for CVE-2026-120091. This advisory will provide the definitive patch information, specific upgrade instructions, and any prerequisite steps.
b. Required Update: Upgrade all instances of AcmeWebFramework to version 2.15.3 or a later, patched version. This update contains the necessary fixes to address the templating engine vulnerability.
c. Patch Application Process:
i. Review Release Notes: Carefully read the release notes for version 2.15.3 to understand any breaking changes or specific upgrade procedures.
ii. Test in Staging: Thoroughly test the patch in a non-production staging environment that mirrors your production setup. Verify application functionality and performance after the upgrade.
iii. Scheduled Deployment: Plan a scheduled maintenance window for production deployment to minimize service disruption.
iv. Rollback Plan: Have a clear rollback plan in case issues arise during or after the patch application.
d. Dependency Updates: Ensure that any third-party libraries or dependencies used