Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state

{
                    "vendor": "Temporal Technologies, Inc.",
                    "product": "Temporal Server",
                    "collectionURL": "https://pkg.go.dev",
                    "packageName": "go.temporal.io/server",
                    "repo": "https://github.com/temporalio/temporal",
                    "modules": [
                        "Frontend",
                        "History"
                    ],
                    "programFiles": [
                        "service/frontend/workflow_handler.go",
                        "components/callbacks/config.go",
                        "components/callbacks/executors.go",
                        "components/callbacks/chasm_invocation.go",
                        "service/history/handler.go",
                        "chasm/lib/scheduler/scheduler.go"
                    ],
                    "programRoutines": [
                        {
                            "name": "WorkflowHandler.validateWorkflowCompletionCallbacks"
                        },
                        {
                            "name": "WorkflowHandler.validateCallbackURL"
                        },
                        {
                            "name": "AddressMatchRules.Validate"
                        },
                        {
                            "name": "chasmInvocation.Invoke"
                        },
                        {
                            "name": "Handler.CompleteNexusOperationChasm"
                        },
                        {
                            "name": "Scheduler.HandleNexusCompletion"
                        }
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.30.0",
                            "lessThan": "1.30.8",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
                    ]
                }

{
                    "vendor": "Temporal Technologies, Inc.",
                    "product": "Temporal Server",
                    "collectionURL": "https://pkg.go.dev",
                    "packageName": "go.temporal.io/server",
                    "repo": "https://github.com/temporalio/temporal",
                    "modules": [
                        "Frontend",
                        "History"
                    ],
                    "programFiles": [
                        "service/frontend/workflow_handler.go",
                        "components/callbacks/config.go",
                        "components/callbacks/executors.go",
                        "components/callbacks/chasm_invocation.go",
                        "chasm/lib/callback/invocable_internal.go",
                        "service/history/handler.go",
                        "chasm/lib/scheduler/scheduler.go"
                    ],
                    "programRoutines": [
                        {
                            "name": "WorkflowHandler.validateWorkflowCompletionCallbacks"
                        },
                        {
                            "name": "WorkflowHandler.validateCallbackURL"
                        },
                        {
                            "name": "AddressMatchRules.Validate"
                        },
                        {
                            "name": "chasmInvocation.Invoke"
                        },
                        {
                            "name": "invocableInternal.Invoke"
                        },
                        {
                            "name": "Handler.CompleteNexusOperationChasm"
                        },
                        {
                            "name": "Scheduler.HandleNexusCompletion"
                        }
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.31.0",
                            "lessThan": "1.31.4",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
                    ]
                }

{
                    "vendor": "Temporal Technologies, Inc.",
                    "product": "Temporal Server",
                    "collectionURL": "https://pkg.go.dev",
                    "packageName": "go.temporal.io/server",
                    "repo": "https://github.com/temporalio/temporal",
                    "modules": [
                        "Frontend",
                        "History"
                    ],
                    "programFiles": [
                        "service/frontend/workflow_handler.go",
                        "chasm/lib/callback/validator.go",
                        "chasm/lib/callback/config.go",
                        "components/callbacks/executors.go",
                        "components/callbacks/chasm_invocation.go",
                        "chasm/lib/callback/invocable_internal.go",
                        "service/history/handler.go",
                        "chasm/lib/scheduler/scheduler.go"
                    ],
                    "programRoutines": [
                        {
                            "name": "WorkflowHandler.prepareStartWorkflowRequest"
                        },
                        {
                            "name": "validator.Validate"
                        },
                        {
                            "name": "AddressMatchRules.Validate"
                        },
                        {
                            "name": "chasmInvocation.Invoke"
                        },
                        {
                            "name": "invocableInternal.Invoke"
                        },
                        {
                            "name": "Handler.CompleteNexusOperationChasm"
                        },
                        {
                            "name": "Scheduler.HandleNexusCompletion"
                        }
                    ],
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.32.0",
                            "lessThan": "1.32.1",
                            "versionType": "semver"
                        }
                    ],
                    "defaultStatus": "unaffected",
                    "cpes": [
                        "cpe:2.3:a:temporal:temporal:*:*:*:*:*:*:*:*"
                    ]
                }