CVE-2026-63342 Details
Description
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.91.1, api-contracts/openapi/paths/v1/workflow-runs/workflow_run.yaml defines the GET /api/v1/stable/durable-tasks/{durable-task} endpoint implemented by listDurableEventLog without requiring the target tenant as a parent resource, allowing an authenticated user who obtains another tenant's durable task UUID to read that task's event log. Disclosed data can include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information. This issue is fixed in version 0.91.1.
A cross-tenant event log disclosure vulnerability has been identified in Hatchet versions prior to 0.91.1. The issue arises in the API endpoint '/api/v1/stable/durable-tasks/{durable-task}', which is implemented by the 'listDurableEventLog' function. This endpoint lacks proper authorization checks for tenant resources, allowing authenticated users to access event logs of durable tasks belonging to other tenants, provided they have the task's UUID. The exposed event log data may include task display names, workflow identifiers, user messages, wait conditions, branching logic, and timing information.
Users can upgrade to Hatchet version 0.91.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hatchet-dev/hatchet/commit/06c1fe43543e853ea98ecc2e6a575e2b8310bbeb | [email protected] | Source CodeVendor |
| https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-g26x-m427-f48f | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hatchet | <= 0.86.29 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | New CVE Received | [email protected] |