CVE-2026-88978

4.3 MEDIUMpublic exploit available

Published 2026-09-21 · Updated 2026-09-21

AI risk analysis

Summary: The flaw allows an authenticated tenant worker to retrieve durable event-log records from another tenant by exploiting a lack of tenant filter in the WorkerStatus gRPC polling path.
Exploitability: Exploitation is unlikely due to UUIDv4 requirement, but preconditions include knowledge of another tenant's durable-task UUID and access to the WorkerStatus gRPC polling path.
Blast radius: If exploited, it could lead to unauthorized access to sensitive event logs, impacting data privacy and security in multi-tenant deployments.
Prioritized remediation: Upgrade to version 0.106.1 or apply a tenant filter to the ListSatisfiedEntries method.

auth-bypassloggingmulti-tenant

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.106.1, the WorkerStatus gRPC polling path in pkg/repository/durable_events.go passes caller-supplied durable task, node, and branch identifiers to ListSatisfiedEntries without a tenant filter, allowing an authenticated tenant worker that knows another tenant's durable-task UUID to retrieve matching durable event-log records. The UUIDv4 requirement makes exploitation unlikely, and single-tenant deployments are unaffected in practice. This issue is fixed in version 0.106.1.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weaknesses

CWE-639, CWE-863

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.