CVE-2026-16652 PUBLISHED

Temporal Server Schedule exclusion search can cause excessive CPU consumption

Assigner: Temporal
Reserved: 22.07.2026 Published: 21.09.2026 Updated: 21.09.2026

Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score: 7.1

Product Status

Vendor Temporal Technologies, Inc.
Product Temporal Server
Versions Default: unaffected
  • affected from 1.17.0 to 1.29.7 (incl.)
  • affected from 1.30.0 to 1.30.7 (excl.)
  • affected from 1.31.0 to 1.31.3 (excl.)

Affected Configurations

In Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound.

Workarounds

Until upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation.

Solutions

Upgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound.

Credits

  • An external security researcher who reported this issue responsibly to Temporal Technologies finder

References

Problem Types

  • CWE-606: Unchecked Input for Loop Condition CWE

Impacts

  • Availability degradation or denial of service caused by excessive CPU consumption and a persistent Schedule retry condition. No confidentiality or integrity impact was identified.