2

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-1243

CVE-2025-1243: Unencrypted transmission in Temporal api-go library

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data Converter transformations (e.g. encryption) applied. This is an issue only when using the UpdateWorkflowExecution APIs (released on 13th January 2025) with a proxy leveraging the api-go library before version 1.44.1.

Other data fields were correctly sent to Data Converter. This issue does not impact the Data Converter server. Data was encrypted in transit. Temporal Cloud services are not impacted.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-1243

CVE-2025-1243:

2

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
go.temporal.io/api	go	< 1.44.1	1.44.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, as described, is that update response information was not sent to the Data Converter for transformations like encryption when using the proxy package. The provided commit dad8b169ada911d3778e070484d1ae78a58bd22b fixes this issue. The core of the fix lies in modifying the visitPayloads and visitFailures functions within proxy/interceptor.go. These functions are responsible for traversing protobuf messages and applying visitor functions to payloads and failures, respectively. The visitor functions are where Data Converter logic would be invoked. Before the patch, these two functions lacked specific case statements in their switch blocks to handle messages of type *update.Response. The patch adds these missing cases, ensuring that when an update.Response is encountered, its Outcome (which can contain payloads or failures) is recursively processed by visitPayloads or visitFailures. Therefore, the vulnerable functions are proxy.visitPayloads and proxy.visitFailures in their pre-patch state, as their omission of handling update.Response directly caused the sensitive information within these responses to bypass the Data Converter. These functions would be in the call stack when the gRPC proxy interceptor processes an UpdateWorkflowExecution API response. The changes in cmd/proxygenerator/interceptor.go are to the code generator that produces the interceptor logic, ensuring that the generated code (which includes visitPayloads and visitFailures) correctly handles update.Response and other update-related types. While this generator is the root cause of the bug in the generated code, the runtime functions exhibiting the vulnerability are visitPayloads and visitFailures.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.