{"id":"CVE-2026-88978","published":"2026-09-21T16:17:26.010","lastModified":"2026-09-21T16:17:26.010","description":"Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwes":["CWE-639","CWE-863"],"vendors":[],"products":[],"references":[{"url":"https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85","tags":[]},{"url":"https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x","tags":[]}],"exploitRefs":[{"url":"https://github.com/hatchet-dev/hatchet/commit/15bc7923d3a8ebfeb0d88c19160dd24828921e85","tags":[]},{"url":"https://github.com/hatchet-dev/hatchet/security/advisories/GHSA-992g-9cr3-vm5x","tags":[]}],"hasPoc":true,"ai":{"summary":"The flaw allows an authenticated tenant worker to retrieve durable event-log records from another tenant by exploiting a lack of tenant filter in the WorkerStatus gRPC polling path.","exploitability":"Exploitation is unlikely due to UUIDv4 requirement, but preconditions include knowledge of another tenant's durable-task UUID and access to the WorkerStatus gRPC polling path.","blast_radius":"If exploited, it could lead to unauthorized access to sensitive event logs, impacting data privacy and security in multi-tenant deployments.","remediation":"Upgrade to version 0.106.1 or apply a tenant filter to the ListSatisfiedEntries method.","tags":["auth-bypass","logging","multi-tenant"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-09-22T06:32:50.111Z"}}