Temporal v1.31.2 - Replication Authorization Release

Temporal v1.31.2 was published on July 8, 2026, and the main operator visible change is authorization coverage for the replication streaming endpoint. For teams running Temporal across clusters, this release is mostly about the security boundary around replication traffic, plus a small base image refresh and an admin tools CLI version bump.

The full release notes and downloads are on the GitHub release page.

The important line in this release is the cherry picked change covering the replication streaming endpoint with authorization. That is the change tied to CVE-2026-5724, which the release marks as MEDIUM.

For platform teams, this sits in the part of Temporal that is easy to treat as internal plumbing until it becomes an incident boundary. Replication traffic is not user facing request traffic, but it carries state between clusters. If authorization policy does not cover that path, a deployment can have a gap between the controls applied to normal service calls and the controls applied to replication streams.

The release notes do not spell out the full exploit shape. They do give enough signal for operators to treat v1.31.2 as a security maintenance release, especially in multi cluster deployments. The practical review is simple: inventory clusters using authorization and replication together, then stage this release where replication health can be observed before and after rollout.

Temporal calls out a potential breaking change for environments that use authorization with replication. The dynamic config key is system.disableStreamingAuthorizer. Setting it to true opts out of the new behavior and can avoid replication traffic connection errors.

That opt out should not be treated as a permanent fix. The notes explicitly say to check the linked CVE for the implications of opting out. In operational terms, the flag is a rollback valve for connection errors during rollout, not a reason to leave the replication stream outside the new authorization path.

The safer upgrade sequence is to test with production shaped authorization config, then confirm replication stream connectivity before widening rollout. Watch server logs around replication stream setup, authorization decisions, and cross cluster task movement. If the deployment needs the opt out, record why, scope it to the affected environment, and remove it after policy or client side compatibility is corrected.

The release also updates Alpine to 3.23.5. The notes do not attach a Temporal behavior change to that update, so this is mostly base image hygiene. It still matters for teams that mirror images, scan SBOMs, or run policy checks against container base versions.

There is also a default CLI version bump to 1.7.2 for v1.31.1 admin tools. That is narrower than a server behavior change, but it is worth checking if automation shells out to the admin tools image. Version drift in operational containers often shows up in scripts that assume output shape, flag defaults, or bundled helper behavior.

Neither item changes the center of gravity of the release. They are secondary checks for pipeline owners: refresh image allow lists, rebuild internal mirrors if needed, and run any scripted admin tool commands in CI before promoting the new artifact.

The release notes include one explicit compatibility concern: deployments using authorization with replication may see replication traffic connection errors after the streaming authorizer change. The documented escape hatch is system.disableStreamingAuthorizer set to true.

Use that key with a clear expiration plan. Leaving it enabled means opting out of the authorization change that shipped with the CVE fix. The right default for most operators is to adapt authorization policy and keep the new coverage enabled.

The full context is on the Temporal v1.31.2 release page, including the changelog comparison from v1.31.1 to v1.31.2.