Temporal Web UI Unauthenticated Access Scanner

Temporal Web UI is a graphical interface used by developers and operations teams to visualize and manage workflows in distributed systems. It provides real-time monitoring, workflow execution control, and debugging capabilities. Organizations rely on it to oversee complex background job processing, ensuring reliability and scalability. Typically deployed internally or via cloud, it is critical for maintaining operational efficiency in microservices architectures.

Unauthenticated Access vulnerability arises when the Temporal Web UI fails to enforce authentication on its endpoints. This occurs due to misconfigurations, default settings, or oversight during deployment. Attackers can exploit this by directly accessing the UI without login credentials, gaining visibility into workflow states and sensitive metadata. The vulnerability stems from insufficient access controls on the web server or application layer.

Specifically, the vulnerability affects the Temporal Web UI's main dashboard and API endpoints such as /namespaces/default/workflows and /api/v1/namespaces. These endpoints expose workflow lists, execution histories, and task queue details. Without authentication, an attacker can enumerate workflows, view input/output data, and even trigger new workflow executions or cancel existing ones, depending on the configuration.

If exploited, an attacker can gain unauthorized control over critical business workflows, potentially disrupting operations, stealing sensitive data, or launching further attacks. This can lead to data breaches, service downtime, and compliance violations. The CVSS score of 7.0 reflects the high impact on confidentiality, integrity, and availability, making remediation urgent.