Read the docs
TI-2026-44164 Aliases CVE-2026-61687GHSA-phg3-3g28-wq9v

hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState

Priority LOW 30CWE-1275Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Security bypass, Tampering, Spoofing
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-287, CWE-352 and CWE-384.

Summary

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, ValidateOAuthState clears the oauth_state_ session value to an empty string after a successful OAuth callback and later accepts an empty state parameter as equal, allowing an unauthenticated attacker to bind a victim's Hatchet session to an attacker-controlled OAuth identity. Exploitation requires the victim to have completed an OAuth flow in the current session and the deployment to enable auth.google.enabled, auth.github.enabled, or the Slack integration. This issue is fixed in version 0.91.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00171 6th percentileScored 2026-11-07
Fix Fixed hatchet (hatchet-dev): 0.91.1github.com/hatchet-dev/hatchet (Go): 0.91.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hatchet-devhatchetbefore 0.91.10.91.1Patch availableCNA
—github.com/hatchet-dev/hatchet (Go)before 0.91.10.91.1Patch availableGHSA-phg3-3g28-wq9v
  • hatchet Vendorhatchet-dev Affected before 0.91.1 Fixed in 0.91.1 Patch available CNA
  • github.com/hatchet-dev/hatchet (Go) Vendor— Affected before 0.91.1 Fixed in 0.91.1 Patch available GHSA-phg3-3g28-wq9v

Remediation

  • Fix · CNA hatchet (hatchet-dev) Fixed in 0.91.1
  • Fix · GHSA-phg3-3g28-wq9v github.com/hatchet-dev/hatchet (Go) Fixed in 0.91.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-61687
  2. 2026-10-03 Alias added: GHSA-phg3-3g28-wq9v
  3. 2026-11-04 Fix available: Go/github.com/hatchet-dev/[email protected] · GHSA-phg3-3g28-wq9v
  4. 2026-11-04 1 new reference · GHSA-phg3-3g28-wq9v

References

Advisory 1

Other 3

  • TI-2026-70733 Unauthenticated memory exhaustion in Hatchet via SNS ingestion endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-39557 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe CVSS 3.1MEDIUM 6.4
  • TI-2026-45168 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check CVSS 3.1MEDIUM 6.3
  • TI-2026-60309 Authorization bypass in hatchet-dev hatchet CVSS 3.1MEDIUM 4.3
  • TI-2026-44159 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler CVSS 3.1MEDIUM 4.1
  • TI-2026-57935 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher CVSS 3.1LOW 3.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences