What is CVE-2026-120091 and how does it work?

CVE-2026-120091 is a critical vulnerability carrying a CVSS score of 8.7 that resides within the Worker Service of Temporal Server como se ha visto en otras fallas de control. The issue stems from how the module compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, which registers a compute provider named k8s to manage workers running inside a Kubernetes cluster.

Instead of relying strictly on operator configuration, the k8s provider built its Kubernetes client from the client configuration supplied directly in the caller's request. Building and utilizing that client could lead to the execution of a command of the caller's choosing on the Worker Service host under the account running the server process.

Who is affected and what are the operational impacts?

Two separate frontend operations can reach the affected provider, notably CreateWorkerDeploymentVersion and ValidateWorkerDeploymentVersionComputeConfig. While the former requires a namespace write role, the latter is registered as a read-only namespace operation similar a problemas de permisos en otros componentes.

Consequently, an authenticated caller holding only a read role in a single namespace can reach the provider without needing a worker deployment to already exist. Because the Worker Service holds persistence credentials and cluster TLS material for every namespace, the impact extends across the entire cluster.

How do I mitigate this vulnerability?

To secure your environments against CVE-2026-120091, administrators must perform a series of mitigation steps immediately. Reviewing current versions and verifying dynamic configuration settings will prevent unauthorized cluster compromise siguiendo guías de mitigación habituales.

  1. Upgrade Temporal Server to version v1.31.5, v1.32.2, or later secure releases.
  2. Check if your deployment falls within versions 1.31.0 through 1.31.2, where compute providers do not deny by default.
  3. Verify the effective value of workercontroller.compute_providers.enabled both globally and across namespace-constrained overrides.
  4. Ensure your custom authorizer properly restricts ValidateWorkerDeploymentVersionComputeConfig to users with namespace write access.