CVE-2026-63342: medium-severity vulnerability in hatchet-dev hatchet
Hatchet: Cross-Tenant Durable Task Event Log Disclosure via Missing Authorization Check
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.3epss 0.3%
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Affected products
hatchet-dev · hatchetRelated CVEs — hatchet-dev hatchet
In the same product, most dangerous first.
CVE-2026-54746MEDIUMHatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and UnsubscribeEPSS 0.4%CVE-2026-108755MEDIUMHatchet through 0.110.5 Unauthenticated Memory Exhaustion via SNS Ingestion EndpointEPSS 0.3%CVE-2026-61681MEDIUMHatchet: SSRF via Unsigned UnsubscribeURL in SNS UnsubscribeConfirmation HandlerEPSS 0.3%CVE-2026-88978MEDIUMHatchet DurableTask WorkerStatus gRPC resolves caller-supplied durable-task UUIDs via ListSatisfiedEntries with no tenant_id filterEPSS 0.3%CVE-2026-84298LOWHatchet: Cross-tenant durable callback payload disclosure in Hatchet V1 DispatcherEPSS 0.2%CVE-2026-42572MEDIUMHatchet: Cross-tenant information disclosure in `listTasksByDAGIds`EPSS 0.2%