Temporal Namespace Validation Bypass Vulnerability in ExecuteMultiOperationRequest

A vulnerability exists in Temporal versions 1.24.0 prior to 1.29.1, allowing users to bypass namespace-specific validation and policies. When the 'frontend.enableExecuteMultiOperation' feature is enabled, the server incorrectly applies validation based on the namespace of an embedded 'StartWorkflowExecutionRequest' instead of the authorized namespace of the outer 'ExecuteMultiOperationRequest'. This flaw enables a user to manipulate the namespace field and circumvent limits or policies, although the workflow is ultimately created in the authorized namespace.

Impact

Exploitation of this vulnerability could lead to unauthorized bypassing of namespace limits and policies, potentially allowing for the execution of workflows that should be restricted under the current namespace's rules.

Remediation

Users can upgrade to Temporal versions 1.27.4, 1.28.2, or 1.29.2 to address this vulnerability.