Read the docs
TI-2026-45168 Aliases CVE-2026-63342GHSA-g26x-m427-f48f

Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check

Priority LOW 28CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-863.

Summary

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00314 24th percentileScored 2026-11-07
Fix Fixed hatchet (hatchet-dev): 0.91.1github.com/hatchet-dev/hatchet (Go): 0.91.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hatchet-devhatchetbefore 0.91.10.91.1Patch availableCNA
—github.com/hatchet-dev/hatchet (Go)before 0.91.10.91.1Patch availableGHSA-g26x-m427-f48f
  • hatchet Vendorhatchet-dev Affected before 0.91.1 Fixed in 0.91.1 Patch available CNA
  • github.com/hatchet-dev/hatchet (Go) Vendor— Affected before 0.91.1 Fixed in 0.91.1 Patch available GHSA-g26x-m427-f48f

Remediation

  • Fix · CNA hatchet (hatchet-dev) Fixed in 0.91.1
  • Fix · GHSA-g26x-m427-f48f github.com/hatchet-dev/hatchet (Go) Fixed in 0.91.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-63342
  2. 2026-10-03 Alias added: GHSA-g26x-m427-f48f

References

Advisory 1

Other 3

  • TI-2026-70733 Unauthenticated memory exhaustion in Hatchet via SNS ingestion endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-44164 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState CVSS 3.1HIGH 7.1
  • TI-2026-39557 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe CVSS 3.1MEDIUM 6.4
  • TI-2026-60309 Authorization bypass in hatchet-dev hatchet CVSS 3.1MEDIUM 4.3
  • TI-2026-44159 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler CVSS 3.1MEDIUM 4.1
  • TI-2026-57935 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher CVSS 3.1LOW 3.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences