CVE-2026-89139 Vulnerability Analysis & Exploit Details

CVE-2026-89139 Vulnerability Summary

CVE-2026-89139: Temporal Server compiles a Worker Controller Instance module into its Worker Service, and that module registers a compute provider named subprocess whose function is to launch a worker by running a command on the machine hosting the Worker Service. The program name and the argument vector that provider executes are taken from the compute provider configuration supplied in the caller's request rather than from operator configuration. An authenticated caller holding only a write role in a single namespace can therefore configure a worker deployment version so that the Worker Service executes a command of the caller's choosing on its own host, under the account the server process runs as. Execution is immediate rather than deferred: the configuration handler invokes every provider using the invoke strategy directly after validating the submitted specification, so no scaling decision, task arrival, or unusual request sequence is required. Because the Worker Service process holds the persistence credentials for every namespace in the cluster and the cluster's TLS material, the consequence reaches beyond the caller's namespace to the cluster as a whole. The provider is present in the official temporal-server binaries and container images for the affected releases. The only control that can keep it unreachable is the compute provider allowlist, the per-namespace dynamic configuration setting workercontroller.compute_providers.enabled, and that control does not deny by default: its default value is an unset list, and the allowlist check is skipped entirely when the value is unset, so every registered compute provider is permitted, this one included. To determine whether a deployment is affected, check the following together. The deployed Temporal Server version is 1.31.0 or later and earlier than 1.31.3. The Worker Service is running, which it is in the default service set and therefore in a stock deployment. The effective per-namespace value of workercontroller.compute_providers.enabled is either unset or contains subprocess. And authorization is configured, meaning a real authorizer and claim mapper are in place; a deployment running with no authorizer already grants every caller unrestricted access to every namespace, so it has no namespace boundary for this to cross. Note that the separate per-namespace dynamic configuration setting workercontroller.enabled does not gate the affected path. It defaults to false, and a deployment that has never set it in any namespace is still affected, which was confirmed by running an affected release with no value for that setting present anywhere in dynamic configuration. To look for a compute configuration that is already attached, call DescribeWorkerDeploymentVersion for each worker deployment version in each namespace and check whether any scaling group's compute provider type is subprocess.

CVE-2026-89139 References

External References

• https://github.com/temporalio/temporal-auto-scaled-workers/pull/129
• https://github.com/temporalio/temporal/pull/12021
• https://github.com/temporalio/temporal/releases/tag/v1.31.3
• https://github.com/temporalio/temporal/releases/tag/v1.32.0

CWE Common Weakness Enumeration

CAPEC Common Attack Pattern Enumeration and Classification

• Exploitation of Thunderbolt Protection Flaws CAPEC-665 An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.

Other 5 Recently Published CVEs Vulnerabilities

• CVE-2026-94383 – The MISP blocklist workflow module accepted a user-supplied blocklist filename parameter without validating the file extension. The only sanitizati...
• CVE-2026-94381 – MISP has a security issue that can let a user gain more access than their API key is supposed to allow. A read-only API key should only let someon...
• CVE-2026-94379 – The login() function in MISP's UsersController.php contained insufficient HTTP method validation for several security-critical code paths. The orig...
• CVE-2026-94374 – MISP contains an insecure direct object reference vulnerability in the processModuleResultsData method of the Event model. When processing module r...
• CVE-2026-94373 – MISP contains a DOM-based cross-site scripting (XSS) vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates ...