A vulnerability in the Temporal Server SQL parser allows authenticated attackers to cause a service crash, leading to a persistent denial of service.

This flaw stems from improper validation of array indices (CWE-129) within the ExtractMysqlComment function, where a failure to check the return value of strings.IndexFunc leads to a Go runtime panic. The vulnerability is reachable by authenticated users with namespace read permissions who can submit specially crafted SQL queries to the affected API.

The exploitation of this vulnerability results in the termination of the receiving Matching process, causing a denial of service for the affected Temporal components. While the vulnerability does not compromise data confidentiality or integrity, the resulting service outage can significantly disrupt business operations that rely on Temporal for workflow orchestration. The CVSS score of 8.7 reflects the high severity of the potential availability impact on critical infrastructure.

Immediate Action: Upgrade the temporalio/sqlparser library to version 0.0.0-20260721183040-74181ffcbaaf or later, and update Temporal Server to versions 1.30.7, 1.31.3, or 1.32.0.

Proactive Monitoring: Monitor server logs for unexpected Go runtime panics or sudden termination of Matching processes associated with SQL parsing tasks.

Compensating Controls: Restrict access to the ListWorkers API and other endpoints that permit SQL query submission to highly trusted service accounts to minimize the attack surface.

Public Exploit Available: Unknown

The risk posed by this denial of service vulnerability is substantial for organizations utilizing Temporal to manage complex workflows. Administrators should prioritize the deployment of the vendor-provided patches, as they explicitly correct the array boundary check logic. Until patches are applied, ensure that access to the affected APIs is strictly controlled and monitored for anomalous behavior.