CVE-2026-42572 Details
Description
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.83.39, a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint caused Hatchet's tenant-membership check to be skipped for this route. A user authenticated to any tenant on the same Hatchet instance could query the endpoint with another tenant's UUID and a DAG UUID belonging to that tenant, and receive task metadata for that DAG. This vulnerability is fixed in 0.83.39.
A vulnerability in Hatchet prior to version 0.83.39 allowed for cross-tenant information disclosure due to a missing authorization directive on the GET /api/v1/stable/dags/tasks endpoint. This omission caused the tenant-membership check to be bypassed, enabling users authenticated to any tenant to query the endpoint with another tenant's UUID and a DAG UUID belonging to that tenant. The response included sensitive task metadata for the queried DAG, such as workflow details and additional metadata that could contain user identifiers or customer IDs. The vulnerability affected multi-tenant Hatchet instances, with self-hosted users needing to upgrade to version 0.83.39 or later.
Self-hosted users should upgrade to Hatchet version 0.83.39 or later. If an immediate upgrade is not possible, account creation can be restricted to control who can register on the instance, and the Hatchet API can be secured by not exposing it to untrusted networks.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 15, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-55gc-6fmc-fpx9 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| hatchet hatchet | < 0.83.39 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 27, 2026 | Initial Analysis | [email protected] |
| May 14, 2026 | New CVE Received | [email protected] |