2025 Temporal — CVE-2025-14986 namespace auth bypass
Data compromised
Potential: cross-tenant workflow data
Technical writeup
DepthFirst found identity-binding bug in ExecuteMultiOperation. Authenticated attackers could bypass namespace authorization; execute operations outside authorized scope. Critical infra used by Netflix, Stripe, Datadog.
Root cause
Authorization bypass; conflicting identity verification