temporalio github.com/temporalio/temporal-proxy vulnerabilities

Latest temporalio github.com/temporalio/temporal-proxy CVEs

Newest publication first

1. CVE-2026-108126 temporal-proxy payload decryption is not bound to the request namespace

   Published 2026-10-15

   Medium·CVSS 6.0 EPSS 0.36%

   temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing i...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.