Snapshot 257425
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Temporal Technologies Inc. Search the Trust Center... Ctrl +K Quick links Website URL Report a Vulnerability Quick links Website URL Report a Vulnerability Badges GDPR HIPAA CCPA Quick Summary One or more annual third-party audit(s) Annual third-party penetration testing Has a disaster recovery plan Subprocessors list available Has cyber insurance Will enter into a DPA Has a bug bounty or vulnerability disclosure program Uses a centralized IAM solution (SSO) to manage employee access Has a status page Has a privacy policy Announcements Nov 11, 2026, 01:00 UTC Fireworks AI security incident Temporal is investigating an indirect impact from the Fireworks AI incident through our internal use of Notion AI. Fireworks AI is a vendor to Notion, not Temporal. To be clear, Notion is not part of delivering Temporal Cloud. We do not store sensitive customer data in Notion and have found no evidence of customer information exposure. We will update this notice as we learn more and notify customers directly if we identify any exposure. Nov 9, 2026, 19:47 UTC CVE-2026-87857 CVE-2026-87857 published in Temporal Server from versions 1.0.0 through 1.29.7, 1.30.0 before 1.30.7, and 1.31.0 before 1.31.3. Temporal Cloud has already been updated, and no action is needed. We recommend upgrading Temporal Server to 1.32.0 or later, 1.31.3, or 1.30.7. Nov 3, 2026, 17:32 UTC CVE-2026-120091 CVE-2026-120091 published in Temporal Server from versions 1.31.0 before 1.31.5 and 1.32.0 before 1.32.2. Version 1.30 and Temporal Cloud are not affected. We recommend upgrading Temporal Server to 1.32.2 or 1.31.5. Until then, remove k8s from workercontroller.compute_providers.enabled; on 1.31.0 through 1.31.2, also set it to an explicit list, since leaving it unset permits every provider. Oct 27, 2026, 18:47 UTC CVE-2026-111497 (Node2Shell / Brotli) Temporal Cloud, Temporal Server, and Temporal SDKs are not impacted by this vulnerability. Oct 22, 2026, 19:00 UTC PHP CVE-2026-109618 and CVE-2026-109619 Temporal Server and Temporal Cloud are not impacted by these PHP vulnerabilities. Our PHP SDK is also not directly affected, as it does not serve web requests. Oct 15, 2026, 19:18 UTC CVE-2026-108126 CVE-2026-108126 published in temporal-proxy from versions 0.2.0 before 0.9.0. We recommend upgrading temporal-proxy to 0.9.0 and setting encryption.namespaceBinding to strict. Oct 12, 2026, 18:48 UTC CVE-2026-104355, CVE-2026-89140 CVE-2026-104355 and CVE-2026-89140 published in Temporal Server from versions 1.30.0 before 1.30.8, 1.31.0 before 1.31.4, and 1.32.0 before 1.32.1. We recommend upgrading Temporal Server to 1.32.1, 1.31.4, or 1.30.8. Sep 21, 2026, 11:46 UTC CVE-2026-16651, CVE-2026-16652, CVE-2026-65651, CVE-2026-65652, CVE-2026-65653, CVE-2026-65654, CVE-2026-87858, CVE-2026-89139 CVEs published in Temporal Server from versions 1.30.0 before 1.30.7 and 1.31.0 before 1.31.3, earlier out-of-support releases, and the Temporal-maintained sqlparser, tchannel-go, and ringpop-go libraries. Temporal Cloud is not affected. We recommend upgrading Temporal Server to 1.32.0, 1.31.3, or 1.30.7. On 1.30.7 and 1.31.3, also set callback.inspectSourceHeader to false once pre-fix servers have drained; 1.32.0 ships it disabled. Aug 11, 2026, 19:42 UTC CVE-2026-65655 CVE-2026-65655 is a Low-severity issue affecting Temporal UI Server versions 2.7.0 through 2.53.1, where OAuth authentication cookies may be issued without the Secure attribute when TLS terminates at a reverse proxy that connects to UI Server over HTTP. Customers using this configuration should upgrade to Temporal UI Server v2.53.2 or later. Jul 9, 2026, 12:55 UTC CVE-2026-5724 CVE published in Temporal Server from versions 1.24.0 before 1.28.4, 1.29.0 before 1.29.6, 1.30.0 before 1.30.4, and 1.31.0 before 1.31.2. We recommend upgrading Temporal Server to the most updated unaffected version. Apr 2, 2026, 12:55 UTC CVE-2026-5199 | CVSS 2.3 (Low) Summary: CVE-2026-519 Recommended Action for OSS Users: Upgrade to v1.29.5 or v1.30.3. Version 1.28 is not affected. Dec 31, 2025, 13:55 UTC CVE-2025-14987 and CVE-2025-14986 CVEs published for Temporal OSS server: CVE-2025-14987 and CVE-2025-14986 We recommend upgrading Temporal Server to 1.27.4, 1.28.2, or 1.29.2. Sep 16, 2025, 12:55 UTC CVE-2025-8396 CVE published in Temporal OSS server default authorizer. We recommend upgrading Temporal Server to 1.26.3, 1.27.3, 1.28.1 or later. Sep 4, 2025, 12:55 UTC Salesloft Drift Security Incident We’re aware of the Salesloft Drift security incident affecting some Salesforce customers. We do not use Drift; our systems and customer data were not impacted by this incident. Feb 12, 2025, 14:00 UTC CVE-2025-1243 CVE published in Temporal api-go library from versions 0 to before 1.44.1. We recommend customers using both the proxy package and a gRPC proxy upgrade the Temporal api-go library to the most updated unaffected version. Jul 20, 2024, 13:00 UTC Microsoft + Crowdstrike Systems Outage We are aware of the outage involving Microsoft systems and Crowdstrike. We have determined that neither Temporal Cloud nor our internal systems are impacted by this event. You can check the status of Temporal Cloud at https://status.temporal.io/. Apr 4, 2024, 13:00 UTC CVE-2024-2689 CVE published in Temporal Server from versions 0 before 1.20.5, 1.21.0 before 1.21.6, and 1.22.0 before 2.22.7. We recommend customers upgrade to Temporal Server to the most updated unaffected version. Apr 3, 2024, 13:00 UTC CVE-2024-2435 CVE published in UI server from versions 2.16.2 before 2.25.0. We recommend customers upgrade to ui-server v2.25.0+. Mar 30, 2024, 13:00 UTC CVE-2024-3094: XZ Utils We are aware of the recently disclosed vulnerability CVE-2024-3094, which involves manipulation of the xz utility from at least version 5.6.0. Following internal investigation, we have determined that Temporal Cloud and the Temporal OSS server image are not impacted by this vulnerability. Feb 1, 2024, 20:53 UTC CVE-2023-3485 2023-07-03: CVE-2023-3485 published. We recommend customers upgrade to 1.20 or later. If unable, the dynamic configuration option frontend.enableTokenNamespaceEnforcement should be set to true. Documents & Knowledge Base FAQs What we offer Temporal Cloud Temporal Cloud is a platform that guarantees the Durable Execution of your application code. It enables you to develop as if failures don't even exist. Your application will run reliably even if it encounters problems, such as network outages or server crashes, which would be catastrophic for a typical application. The Temporal Platform handles these types of problems, allowing you to focus on the business logic, instead of writing application code to detect and recover from failures. Typical data access: Username, Email Address, Business Workflow State Certifications: SOC 2 Type 2, HIPAA Subprocessors7 Subprocessor Location of Processing Usage Details Auth0 United States Authentication AWS Customer-Defined Jurisdiction Infrastructure for Namespaces that customers decide to host in Amazon Web Services. Control plane. Elastic Customer-Defined Jurisdictions (Optional) Visibility, monitoring and analysis of business and operational data for Namespaces hosted in Google Cloud or Microsoft Azure. Google Cloud Customer-Defined Jurisdictions (Optional) Infrastructure for Namespaces that customers decide to host in Google Cloud. IBM Customer-Defined Jurisdictions Datastax Database Microsoft Azure Customer-Defined Jurisdictions (Optional) Infrastructure for Namespaces that customers decide to host in Microsoft Azure. WorkOS United States Customer identity and access management platform Last updated May 29, 2026. . View as: Trusted by S Powered by Conveyor, the first end-to-end customer trust platform. Learn more