[ CVE-2026-88978 · Published 21 Sep 2026 ]
Hatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filter
CVSS 4.3
EPSS <1%Fix available
[ Description ]Official description
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.
[ Fixes ]Fixes and patches
- github.com/hatchet-dev/hatchet 0.106.1Fixed version · GitHub Advisories · go package github.com/hatchet-dev/hatchet: upgrade to 0.106.1 or later (affected < 0.106.1)
[ Packages ]Affected open-source packages
- github.com/hatchet-dev/hatchet goAffected < 0.106.1 · fixed in 0.106.1 · GHSA-992g-9cr3-vm5x