{"id":"CVE-2025-14986","aliases":["GHSA-p2gr-hm8g-q772","GO-2025-4272"],"url":"https://o3.security/vulnerability/CVE-2025-14986","summary":"ExecuteMultiOperation Namespace Policy Bypass","details":"When frontend.enableExecuteMultiOperation is enabled, the server can apply namespace-scoped validation and feature gates for the embedded StartWorkflowExecutionRequest using its Namespace field rather than the outer, authorized ExecuteMultiOperationRequest.Namespace. This allows a caller authorized for one namespace to bypass that namespace's limits/policies by setting the embedded start request's namespace to a different namespace. The workflow is still created in the outer (authorized) namespace; only validation/gating is performed under the wrong namespace context.\nThis issue affects Temporal: from 1.24.0 through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.","published":"2025-12-30T20:17:47.201Z","modified":"2026-08-12T03:51:40.836953269Z","cvss":null,"epss":{"score":0.00428,"percentile":0.36518,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"go.temporal.io/server","fixedVersion":"1.27.4"},{"ecosystem":"Go","name":"go.temporal.io/server","fixedVersion":"1.28.2"},{"ecosystem":"Go","name":"go.temporal.io/server","fixedVersion":"1.29.2"}],"fix":{"url":"https://github.com/temporalio/temporal/pull/8839","label":"temporalio/temporal#8839"},"references":[{"type":"WEB","url":"https://github.com/temporalio/temporal/releases/tag/v1.27.4"},{"type":"WEB","url":"https://github.com/temporalio/temporal/releases/tag/v1.28.2"},{"type":"WEB","url":"https://github.com/temporalio/temporal/releases/tag/v1.29.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/14xxx/CVE-2025-14986.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-14986"},{"type":"PACKAGE","url":"https://github.com/temporalio/temporal"},{"type":"WEB","url":"https://github.com/temporalio/temporal/pull/8839"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:40.836953269Z"}}