CVE-2025-14986 ExecuteMultiOperation Namespace Policy Bypass
Attackers can bypass namespace-specific policies and limits in Temporal by exploiting a validation flaw in multi-operation requests when a specific feature is enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-14986?
CVE-2025-14986 is a low-severity missing authorization vulnerability in Temporal, published on 30 Dec 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context. This issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
Weakness: CWE-863
Which versions are affected by CVE-2025-14986?
7 open source packages ship an affected version, including go.temporal.io/server.
| Package | Affected | Fixed in |
|---|---|---|
go.temporal.io/server Go | From 1.24.0 | 1.27.4, 1.28.2, 1.29.2 |
go.temporal.io/server Go | From 1.24.0 | 1.27.4 |
go.temporal.io/server Go | From 1.24.0 | 1.27.4 |
go.temporal.io/server Go | From 1.28.0 | 1.28.2 |
go.temporal.io/server Go | From 1.28.0 | 1.28.2 |
go.temporal.io/server Go | From 1.29.0 | 1.29.2 |
1 more packages
go.temporal.io/server Go | From 1.29.0 | 1.29.2 |
How do I fix CVE-2025-14986?
Upgrade go.temporal.io/server to a fixed version for your release line: 1.27.4, 1.28.2 or 1.29.2.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-14986 being exploited?
There is no known exploitation of CVE-2025-14986 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-NH98703, CLEANSTART-2026-SU00653, GHSA-p2gr-hm8g-q772, GO-2025-4272.