CVE-2026-16652

Summary

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.

Affected Software

VendorProductVersion RangeStatus
Temporal Technologies, Inc.Temporal Server1.17.0 <= 1.29.7affected
Temporal Technologies, Inc.Temporal Server1.30.0 < 1.30.7affected
Temporal Technologies, Inc.Temporal Server1.31.0 < 1.31.3affected

Weaknesses

  • CWE-606: CWE-606: Unchecked Input for Loop Condition

Workarounds

Until upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

References