CVE-2026-5724

CVE-2026-5724 affects self-hosted Temporal installations running with ClaimMapper and Authorizer authentication configured. The vulnerability exists in the frontend gRPC server's streaming interceptor chain, which fails to include the authorization interceptor for the AdminService/StreamWorkflowReplicationMessages endpoint. This allows unauthenticated users to access a streaming endpoint that should require credentials, though exploitation requires network access to the frontend port and knowledge of cluster configuration details. The attack vector is network-based with low complexity, as an attacker only needs to initiate a connection to the exposed endpoint without authentication. However, the actual impact is constrained by validation controls in the history service, which verifies cluster IDs and peer membership before returning replication data. Data exfiltration is theoretically possible but depends on the attacker having advance knowledge of the cluster configuration and a correctly configured replication target. The vulnerability has a FAUCET Risk Score of 44.0 out of 100 and an EPSS score of 0.00038, indicating it ranks higher than approximately 0.11 percent of all CVEs in terms of exploitation likelihood. There is no indication of active exploitation, and the vulnerability does not appear on the Known Exploited Vulnerabilities list. Temporal Cloud is not affected, limiting the scope to organizations operating self-hosted instances.