An authenticated OS command injection vulnerability in Temporal Server 1.31.x allows remote attackers to gain unauthorized code execution on the underlying server host with the privileges of the service process.

The software contains an insecurely configured subprocess compute provider that accepts user-supplied commands. Any authenticated user with a write role in a single namespace can trigger this function to execute arbitrary OS commands on the host running the Worker Service.

The exploitation of this vulnerability results in full system compromise of the Temporal Server host, as the attacker gains the execution context of the server process. Given that the process retains persistence credentials and cluster TLS material, an attacker can escalate access beyond their assigned namespace to the entire cluster. With a CVSS score of 8.7, this represents a high-severity risk that could lead to complete data theft, lateral movement, and total loss of confidentiality, integrity, and availability.

Immediate Action: Upgrade Temporal Server to version 1.31.3 or 1.32.0 immediately to enforce a secure default allowlist for compute providers.

Proactive Monitoring: Review audit logs for unusual process execution patterns or unexpected calls to DescribeWorkerDeploymentVersion that include the subprocess compute provider type.

Compensating Controls: Ensure the workercontroller.compute_providers.enabled dynamic configuration is explicitly set to a restrictive allowlist that excludes subprocess if an immediate upgrade is not feasible.

Public Exploit Available: Unknown

This vulnerability poses a significant risk to cluster integrity and should be addressed as a priority. Administrators must verify their current deployment versions and configuration settings immediately, as the default state of the software is inherently vulnerable. Applying the vendor-provided security update is the only definitive method to remediate the underlying command injection flaw.