CVE-2026-16652

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

• https://github.com/temporalio/temporal/commit/c10c730e53ae394fffaefe44ba3722150fe40720 security@temporal.io
• https://github.com/temporalio/temporal/pull/11014 security@temporal.io
• https://github.com/temporalio/temporal/releases/tag/v1.30.7 security@temporal.io
• https://github.com/temporalio/temporal/releases/tag/v1.31.3 security@temporal.io

The full cvelistV5 record. Download as CVE-2026-16652.json.

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-16652",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-21T15:32:53.335177Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-21T15:33:15.387Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "cpes": [
            "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "modules": [
            "Schedules"
          ],
          "packageName": "go.temporal.io/server",
          "product": "Temporal Server",
          "programFiles": [
            "service/worker/scheduler/spec.go"
          ],
          "programRoutines": [
            {
              "name": "CompiledSpec.GetNextTime"
            }
          ],
          "repo": "https://github.com/temporalio/temporal",
          "vendor": "Temporal Technologies, Inc.",
          "versions": [
            {
              "lessThanOrEqual": "1.29.7",
              "status": "affected",
              "version": "1.17.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.30.7",
              "status": "affected",
              "version": "1.30.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.31.3",
              "status": "affected",
              "version": "1.31.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<p>In Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound.</p>"
            }
          ],
          "value": "In Temporal Server 1.17.x, Schedule APIs were disabled by default and the issue was reachable only when frontend.enableSchedules was enabled. Schedule APIs are enabled by default beginning in 1.18.0. In fixed releases, scheduler.specMaxIterations must remain positive. Setting it to zero or a negative value disables the hard work bound."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "An external security researcher who reported this issue responsibly to Temporal Technologies"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<p>Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data.</p>"
            }
          ],
          "value": "Temporal Server did not bound the work performed while searching for a Schedule's next action time. An authenticated caller with namespace write permission could create or update a Schedule that combines a fine-grained cadence with an exclusion calendar that rejects every candidate time, causing the server to evaluate excluded candidates without a per-search work budget. This can consume excessive CPU in Frontend and Schedule worker components. A persisted specification can also cause its backing Schedule Workflow to repeatedly fail and retry, allowing CPU consumption to continue without additional requests until the Schedule is deleted or its backing Workflow is terminated. Repeated or parallel exploitation can deny service. The issue affects availability only; it does not expose or modify Workflow data."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "Availability degradation or denial of service caused by excessive CPU consumption and a persistent Schedule retry condition. No confidentiality or integrity impact was identified."
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "exploitMaturity": "NOT_DEFINED",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-606",
              "description": "CWE-606: Unchecked Input for Loop Condition",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-21T11:23:47.298Z",
        "orgId": "61241ed8-fa44-4f23-92db-b8c443751968",
        "shortName": "Temporal"
      },
      "references": [
        {
          "name": "Fix pull request",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/pull/11014"
        },
        {
          "name": "Fix commit",
          "tags": [
            "patch"
          ],
          "url": "https://github.com/temporalio/temporal/commit/c10c730e53ae394fffaefe44ba3722150fe40720"
        },
        {
          "name": "Temporal Server 1.30.7",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.30.7"
        },
        {
          "name": "Temporal Server 1.31.3",
          "tags": [
            "release-notes"
          ],
          "url": "https://github.com/temporalio/temporal/releases/tag/v1.31.3"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<p>Upgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound.</p>"
            }
          ],
          "value": "Upgrade to Temporal Server 1.30.7, 1.31.3, or 1.32.0, as appropriate for the deployed minor release line, and retain a positive scheduler.specMaxIterations value. The fix bounds the number of excluded candidates evaluated by each next-action search and stops the search with an error when the bound is reached. Review and replace or remove Schedule specifications that exceed the configured bound. Setting scheduler.specMaxIterations to zero or a negative value disables the hard bound."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Temporal Server Schedule exclusion search can cause excessive CPU consumption",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "<p>Until upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation.</p>"
            }
          ],
          "value": "Until upgrading, set frontend.enableSchedules to false for namespaces that do not require Schedules. This prevents new Schedule API triggers but does not repair already-running problematic Schedules. For namespaces that must retain the feature, restrict Schedule creation and update to trusted principals and delete Schedules whose exclusions prevent next-action computation from completing. Rate limiting alone is insufficient because it does not bound the work caused by one accepted evaluation."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "61241ed8-fa44-4f23-92db-b8c443751968",
    "assignerShortName": "Temporal",
    "cveId": "CVE-2026-16652",
    "datePublished": "2026-09-21T11:23:47.298Z",
    "dateReserved": "2026-07-22T18:08:55.806Z",
    "dateUpdated": "2026-09-21T15:33:15.387Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}