CVE-2026-84298 Details
Description
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores worker-supplied task_external_id values in the durableInvocations routing map before tenant ownership is verified, and callback delivery resolves that map by task UUID without tenant identity. An authenticated tenant worker that knows another tenant's durable task UUID and keeps a stream open on the same dispatcher process can receive that task's durable callback result payload. UUIDv4 values are not enumerable, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.95.3.
A cross-tenant callback payload disclosure vulnerability exists in Hatchet versions through 0.86.2. The issue arises in the V1 DurableTask stream handler, which improperly registers worker-supplied task external IDs in a callback routing map before verifying tenant ownership. This flaw allows an authenticated tenant worker to intercept callback results from another tenant, provided they know the target tenant's durable task UUID and maintain an open stream on the same dispatcher process. While this vulnerability is present in multi-tenant deployments, the likelihood of exploitation is low due to the need for out-of-band knowledge of the UUID.
Users can upgrade to Hatchet version 0.95.3 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 21, 2026CISA-ADP
Assessed Sep 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/hatchet-dev/hatchet/commit/9555bfdd1e97f61d25e614ccaa107c5fb7dc4976 | [email protected] | Source CodeVendor |
| https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-9q4h-f4x5-ffq8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Hatchet | <= 0.86.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 21, 2026 | CVE Modified | CISA-ADP |
| Sep 21, 2026 | New CVE Received | [email protected] |