Read the docs
TI-2026-60309 Aliases CVE-2026-88978GHSA-992g-9cr3-vm5x

Authorization bypass in hatchet-dev hatchet

Priority LOW 20CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00281 20th percentileScored 2026-11-07
Fix Fixed hatchet (hatchet-dev): 0.106.1github.com/hatchet-dev/hatchet (Go): 0.106.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
hatchet-devhatchetbefore 0.106.10.106.1Patch availableCNA
—github.com/hatchet-dev/hatchet (Go)before 0.106.10.106.1Patch availableGHSA-992g-9cr3-vm5x
  • hatchet Vendorhatchet-dev Affected before 0.106.1 Fixed in 0.106.1 Patch available CNA
  • github.com/hatchet-dev/hatchet (Go) Vendor— Affected before 0.106.1 Fixed in 0.106.1 Patch available GHSA-992g-9cr3-vm5x

Remediation

  • Fix · CNA hatchet (hatchet-dev) Fixed in 0.106.1
  • Fix · GHSA-992g-9cr3-vm5x github.com/hatchet-dev/hatchet (Go) Fixed in 0.106.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-88978
  2. 2026-10-03 Alias added: GHSA-992g-9cr3-vm5x

References

Advisory 1

Other 3

  • TI-2026-70733 Unauthenticated memory exhaustion in Hatchet via SNS ingestion endpoint CVSS 4.0MEDIUM 6.9
  • TI-2026-44164 hatchet - Unauthenticated OAuth state CSRF / login-CSRF via empty-state collision in ValidateOAuthState CVSS 3.1HIGH 7.1
  • TI-2026-39557 Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe CVSS 3.1MEDIUM 6.4
  • TI-2026-45168 Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check CVSS 3.1MEDIUM 6.3
  • TI-2026-44159 Hatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation Handler CVSS 3.1MEDIUM 4.1
  • TI-2026-57935 Hatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 Dispatcher CVSS 3.1LOW 3.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences